title: Django returns 403 error on POST request with Fetch
body: <p>I have a graphql server implemented using <a href="https://github.com/graphql-python/graphene-django" rel="nofollow noreferrer">graphene-django</a>. I can make queries to it using jquery like this:</p>
  
  <pre><code>function allIngredients() {
      return 'query{allProducts{edges{node{name}}}}'
    }
    var query = allIngredients();
    $.ajaxSetup({
      data: {csrfmiddlewaretoken: '{{ csrf_token }}' },
    });
    $.post("/graphql", {query: query}, function(response) {
      console.log(response);
    })
  </code></pre>
  
  <p>However, when I try this call with Fetch, I get a 403, because of the CORS issue. I solved the same problem in jQuery by adding ajaxSetup... before the call.</p>
  
  <p>Here's the call using fetch:</p>
  
  <pre><code>fetch('/graphql', {
          method: "POST",
          headers: {
            'Content-Type': 'application/json'
          },
          credentials: 'include',
          body: JSON.stringify({
            csrfmiddlewaretoken: '{{ csrf_token }}',
            query:`{allProducts{
              edges{
                node{
                  id
                  name
                  orderPrice
                  sellPrice
                }
              }
            }`})
        }
      )
      .then(function(response) {
          if (response.status &gt;= 400) {
              throw new Error("Bad response from server");
          }
          return response.json();
      })
  </code></pre>
  
  <p>I tried adding csrfmiddlewaretoken to the body in the similar way as I did in jQuery example, no luck. I tried adding credentials: 'include' as <a href="https://github.com/github/fetch#sending-cookies" rel="nofollow noreferrer">the docs say</a>, again no luck. I tried with credentials: 'same-origin' and combining this options differently, again the same result. Web is unusually quiet about this, what am I doing wrong?</p>