     performance penalty for those requests that don't have a session.
  
  2. On all incoming POST requests that have the session cookie set, it
     checks that the 'csrfmiddlewaretoken' is present and correct. If it
     isn't, the user will get a 403 error.
  
  This ensures that only forms that have originated from your Web site
  can be used to POST data back.
  
  It deliberately only targets HTTP POST requests (and the corresponding POST
 
</s> remove         Check the AJAX requests are automatically exempted.
 </s> add         Check that AJAX requests are automatically exempted. </s> remove You don't have to worry about doing this for most AJAX views. Any request sent
with "X-Requested-With: XMLHttpRequest" is automatically exempt. (See the next
section.)
 </s> add Like the middleware itself, the ``csrf_exempt`` decorator is composed
of two parts: a ``csrf_view_exempt`` decorator and a
``csrf_response_exempt`` decorator, found in the same module.  These
disable the view protection mechanism (``CsrfViewMiddleware``) and the
response post-processing (``CsrfResponseMiddleware``) respectively.
They can be used individually if required.

You don't have to worry about doing this for most AJAX views. Any
request sent with "X-Requested-With: XMLHttpRequest" is automatically
exempt. (See the next section.) </s> remove             # This covers a corner case in which the outgoing request
 </s> add             # This covers a corner case in which the outgoing response </s> remove The above two functions of ``CsrfMiddleware`` are split between two
classes: ``CsrfResponseMiddleware`` and ``CsrfViewMiddleware``
respectively.  This allows the individual components to be used and/or
replaced instead of using ``CsrfMiddleware``.

.. versionchanged:: 1.1
    (previous versions of Django did not provide these two components
    of ``CsrfMiddleware`` as described above)
 </s> add 
   isn't, the user will get a 403 error. (This is done by
   ``CsrfViewMiddleware``)
     performance penalty for those requests that don't have a session.
  
  2. On all incoming POST requests that have the session cookie set, it
     checks that the 'csrfmiddlewaretoken' is present and correct. If it
   isn't, the user will get a 403 error. (This is done by
   ``CsrfViewMiddleware``)
  
  This ensures that only forms that have originated from your Web site
  can be used to POST data back.
  
  It deliberately only targets HTTP POST requests (and the corresponding POST
keep keep keep keep replace keep keep keep keep keep
 Made CSRF middleware skip post-processing for 'csrf_exempt' decorated views.

This commit also decomposes the decorator into two decorators which can be
used separately, adds some tests, updates docs and fixes some code comments.



git-svn-id: http://code.djangoproject.com/svn/django/trunk@9815 bcc190cf-cafb-0310-a4f2-bffc1f526a37 
docs/ref/contrib/csrf.txt