     'POST' forms, with the name 'csrfmiddlewaretoken' and a value which is
     a hash of the session ID plus a secret. If there is no session ID set,
     this modification of the response isn't done, so there is very little
     performance penalty for those requests that don't have a session.
  
  2. On all incoming POST requests that have the session cookie set, it
     checks that the 'csrfmiddlewaretoken' is present and correct. If it
     isn't, the user will get a 403 error. (This is done by
     ``CsrfViewMiddleware``)
 
</s> remove    isn't, the user will get a 403 error.
 </s> add    isn't, the user will get a 403 error. (This is done by
   ``CsrfViewMiddleware``) </s> remove You don't have to worry about doing this for most AJAX views. Any request sent
with "X-Requested-With: XMLHttpRequest" is automatically exempt. (See the next
section.)
 </s> add Like the middleware itself, the ``csrf_exempt`` decorator is composed
of two parts: a ``csrf_view_exempt`` decorator and a
``csrf_response_exempt`` decorator, found in the same module.  These
disable the view protection mechanism (``CsrfViewMiddleware``) and the
response post-processing (``CsrfResponseMiddleware``) respectively.
They can be used individually if required.

You don't have to worry about doing this for most AJAX views. Any
request sent with "X-Requested-With: XMLHttpRequest" is automatically
exempt. (See the next section.) </s> remove             # This covers a corner case in which the outgoing request
 </s> add             # This covers a corner case in which the outgoing response </s> remove     Marks a view function as being exempt from the CSRF checks
 </s> add     Modifies a view function so that its response is exempt
    from the post-processing of the CSRF middleware.
    """
    def wrapped_view(*args, **kwargs):
        resp = view_func(*args, **kwargs)
	resp.csrf_exempt = True
	return resp
    return wraps(view_func)(wrapped_view)

def csrf_view_exempt(view_func): </s> remove         resp_content = resp.content
 </s> add 	resp_content = resp.content # needed because process_response modifies resp
   (This is done by ``CsrfResponseMiddleware``).
     'POST' forms, with the name 'csrfmiddlewaretoken' and a value which is
     a hash of the session ID plus a secret. If there is no session ID set,
     this modification of the response isn't done, so there is very little
     performance penalty for those requests that don't have a session.
   (This is done by ``CsrfResponseMiddleware``).
  
  2. On all incoming POST requests that have the session cookie set, it
     checks that the 'csrfmiddlewaretoken' is present and correct. If it
     isn't, the user will get a 403 error. (This is done by
     ``CsrfViewMiddleware``)
keep keep keep add keep keep keep keep keep
 Made CSRF middleware skip post-processing for 'csrf_exempt' decorated views.

This commit also decomposes the decorator into two decorators which can be
used separately, adds some tests, updates docs and fixes some code comments.



git-svn-id: http://code.djangoproject.com/svn/django/trunk@9815 bcc190cf-cafb-0310-a4f2-bffc1f526a37 
docs/ref/contrib/csrf.txt