I have a simple form:

```

{% block content %}
<p> Upload invoices </p>
  <form method="post" action="{% url 'upload_thing ' %}" enctype="multipart/form-data">
    {% csrf_token %}
    <input type="file" name="invoice_thing">
    <button type="submit">Upload</button>
  </form>

```

I have a view 

```

@require_POST
@transaction.atomic
def upload_thing(request): 
      ....

```

How do I make sure that the no one can hit the post endpoint via curl or postman?

I want the end point to be accessible only by hitting the form button. The only people who can do this are admin users.

How do I accomplish this?