title: Having a POST'able API and Django's CSRF Middleware
body: <p>I have a Django webapp that has both a front-end, web-accessible component and an API that is accessed by a desktop client.  However, now with the new CSRF middleware component, API requests from the desktop client that are POST'ed get a 403.</p>
  
  <p>I understand why this is happening, but what is the proper way to fix this without compromising security?  Is there someway I can signal in the HTTP header that it's an API request and that Django shouldn't be checking for CSRF or is that a bad strategy?</p>
  
  <p><strong><em>Edit--</em></strong></p>
  
  <p>The method I'm using at the moment is that the desktop client sets a header, X-Requested-With: XMLHttpRequest.  This is kinda hacky, but I'm not sure how this would be handled better.</p>