title: Why DRF shows Forbidden (CSRF cookie not set.) without @api_view(['POST'])?
body: <p>I'm learning react and try to make a login form using django-rest-framework(backend) and react(frontend). In react i created a login form ,when i submite the form it sends an axios.post to my view function. The problem is django raise a error and the message: Forbidden (CSRF cookie not set.)</p>
  <p><strong>Obs1:If i include de @api_view(['POST']) decorator works, but i want to know if is possible make the request without it.</strong></p>
  <p><strong>Obs2: When my react form render, a function that creates a csrf_token was called, so the csrf_token its being sent but django isn't reading it</strong></p>
  <p><strong>Obs3: My django is in <a href="http://127.0.0.1:8000/" rel="nofollow noreferrer">http://127.0.0.1:8000/</a> and my reactapp is in <a href="http://192.168.56.1:3000." rel="nofollow noreferrer">http://192.168.56.1:3000.</a></strong></p>
  <p>When my Login render:</p>
  <pre><code>useEffect(()=&gt;{
      axios({method:'get', url:'http://127.0.0.1:8000/usuario/gera})
      .then(response=&gt;{
          setToken(response.data)
      })
      .catch(error=&gt;{})
  },[])
  </code></pre>
  <p>When the form is submited:</p>
  <pre><code>function logar(e){
      document.cookie = `X-CSRFToken=${token}`
      login(email, senha1)
      e.preventDefault()
  }
  </code></pre>
  <p>My axios(inside login function):</p>
  <pre><code>let token = getCookie('X-CSRFToken');
  
  axios({
      method:'post', 
      url: url, 
      data:{email:email, password1:senha},
      headers: {'X-CSRFTOKEN': token},
      withCredentials: true
  })
  .then((response)=&gt;{
      console.log(`Reposta: ${response.data}`)
  })
  .catch((error)=&gt;{
      console.log(`Erro: ${error.data}`)
  });
  </code></pre>
  <p>My django view:</p>
  <pre><code>def login_usuario(request):
      if request.method == 'POST':
          return HttpResponse('Something')
  </code></pre>
  <p>My django settings:</p>
  <pre><code>CSRF_HEADER_NAME = 'HTTP_X_CSRFTOKEN'
  
  CSRF_COOKIE_NAME = 'X-CSRFTOKEN'
  
  CORS_ALLOW_HEADERS = [
      'X-CSRFTOKEN',
      'csrftoken',
      'X-XSRF-TOKEN',
      'content-type',
      'x-requested-with',
      'Authorization',
      'Set-Cookie'
  ]
  
  CORS_ALLOW_CREDENTIALS = True
  
  CSRF_TRUSTED_ORIGINS = ['http://localhost:3000']
  
  CSRF_COOKIE_DOMAIN = 'http://192.168.56.1:3000' 
  
  CSRF_COOKIE_PATH = 'http://localhost:3000'
  
  SESSION_COOKIE_DOMAIN = 'http://localhost:3000'
  </code></pre>