title: Security using Django 1.10 + AJAX without any HTML form
body: <p>I make a POST request via AJAX without HTML form.
  Are there any security issues?
  Why is there no csrf error? Because I do not send any csrf data and csrf is enabled in django?</p>
  
  <p>toggle-status.js</p>
  
  <pre><code>jQuery(document).ready(function($) {
      $("#switch-status").click(function(){
      $.ajax({
          url: '/account/switches/',
          data: {'toggle': 'status'}
      });
      });
  });
  </code></pre>
  
  <p>view.py</p>
  
  <pre><code>@login_required
  def switches(request):
      toggle = request.GET.get('toggle', None)
      current_user = request.user
      update = Switches.objects.get(owner=current_user)
      if toggle == 'status':
      if update.status is True:
          update.status = False
      else:
          update.status = True
      update.save()
      return HttpResponse('')
  </code></pre>