title: Django CSRF token missing and API
body: <p>I am using django 1.11.2 and rest-framework 3.6.3 and the error about csrf token missing is always appearing when sending a react form to API. The annoying thing is that it appears to my only tester/helper (who is quite PC iliterate, that's why he is testing), not to me. </p>
  
  <p>I was able to reproduce the situation in private browsing only, the CSRF cookie is not appearing even when i set ensure_csrf_cookie on the view. Any ideas how to solve this?</p>
  
  <p>This is my settings:</p>
  
  <pre><code>INSTALLED_APPS = (
  'django.contrib.admin',
  'django.contrib.auth',
  'django.contrib.contenttypes',
  'django.contrib.sessions',
  'django.contrib.messages',
  'django.contrib.staticfiles',
  'django.contrib.sites',
  'django.contrib.flatpages',
  
  'rest_framework',
  'rest_framework.authtoken',
  'rest_auth',
  'drf_braces',
  'allauth',
  'allauth.account',
  'allauth.socialaccount',
  'allauth.socialaccount.providers.facebook',
  'allauth.socialaccount.providers.google',
  'allauth.socialaccount.providers.linkedin_oauth2',
  'rest_auth.registration', (...)
  
  MIDDLEWARE_CLASSES = (
  'django.contrib.sessions.middleware.SessionMiddleware',
  'django.middleware.common.CommonMiddleware',
  'django.middleware.csrf.CsrfViewMiddleware',
  'django.contrib.auth.middleware.AuthenticationMiddleware',
  'django.contrib.auth.middleware.SessionAuthenticationMiddleware',
  'django.contrib.messages.middleware.MessageMiddleware',
  
  'django.middleware.clickjacking.XFrameOptionsMiddleware',
  
  'django.middleware.security.SecurityMiddleware',
  'django.contrib.flatpages.middleware.FlatpageFallbackMiddleware',
  'project.middleware.TimezoneMiddleware'
  
  REST_FRAMEWORK = {
  'DEFAULT_AUTHENTICATION_CLASSES': (
      'rest_framework.authentication.BasicAuthentication',
      'rest_framework.authentication.SessionAuthentication',
  ),
  'DEFAULT_THROTTLE_CLASSES': (
      'rest_framework.throttling.AnonRateThrottle',
      'rest_framework.throttling.UserRateThrottle'
  ),
  'DEFAULT_THROTTLE_RATES': {
      'anon': '60/minute',
      'user': '60/minute'
  }
  </code></pre>
  
  <p>}</p>
  
  <p>I have tried to use rest-framework's api_view decorator and also the ensure csrf decorator. Nothing helped. The view is class based (from FormView) and the post method, that doesn't work, looks like this:</p>
  
  <pre><code>from rest_framework.decorators import api_view
  from django.utils.decorators import method_decorator
  
  #@method_decorator(ensure_csrf_cookie)
  @api_view(['POST','GET'])
  def post(self, request, *args, **kwargs):
      (...)
  </code></pre>
  
  <p>The csrf token is retrieved in react code the usual django way. For this purpose I build a csrf react component, that looks like this:</p>
  
  <pre><code>function getCookie(name) {
      var cookieValue = null;
      if (document.cookie &amp;&amp; document.cookie != '') {
          var cookies = document.cookie.split(';');
  
          for (var i = 0; i &lt; cookies.length; i++) {
              var cookie = $.trim(cookies[i]);
              if (cookie.substring(0, name.length + 1) == (name + '=')) {
                  cookieValue = decodeURIComponent(
                    cookie.substring(name.length + 1)
                    );
                  break;
              }
          }
      }
  return cookieValue;
  }
  
  
  var DjangoCSRFToken = React.createClass({
    getInitialState: function() {
      var csrftoken = getCookie('csrftoken');
      //saving to FormStore, to be send later to the server
      this.props.setValue('csrfmiddlewaretoken',csrftoken);
      return {};
    },
  
    render: function() {
  
      var csrftoken = getCookie('csrftoken');
  
      return React.DOM.input(
        {type:"hidden", name:"csrfmiddlewaretoken", value:csrftoken}
        );
    }
  });
  </code></pre>