CSRF

[akx]

Wondering what might be a good way to deal with CSRF/XSRF.

Prior art, i.e. what DRF does, is to only use Django's CSRF protection when authenticating with methods other than session authentication.

Right now Lepo doesn't even deal with authentication.

[akx]

Perhaps Lepo should check whether the csrf_exempt attribute is present on the handler and decorate the view accordingly.