title: Django csrf_exempt not working with SessionAuthentication
body: <p>I'm using Django Rest Framework to build a webapp with user registration/login. 
  I'm trying to exempt the user sign up view from needing a CSRF token. This is what my view looks like right now:</p>
  
  <pre><code>class UserSignUpView(generics.CreateAPIView):
      permission_classes = [] # FIXME: doesn't seem to be working
      serializer_class = UserSerializer
  
      @method_decorator(csrf_exempt)
      def post(self, request, *args, **kwargs):
          super().post(self, request, *args, **kwargs)
  
      def get_permissions(self):
          if self.request.method == 'POST':
              return (permissions.AllowAny(), TokenHasReadWriteScope())
          return False
  </code></pre>
  
  <p>My settings.py looks like this:</p>
  
  <pre><code>REST_FRAMEWORK = {
      # Use Django's standard `django.contrib.auth` permissions,
      # or allow read-only access for unauthenticated users.
      'DEFAULT_AUTHENTICATION_CLASSES': (
          'rest_framework.authentication.BasicAuthentication',
          'rest_framework.authentication.SessionAuthentication',
      ),
      'DEFAULT_PERMISSION_CLASSES': [
         'rest_framework.permissions.AllowAny',
      ]
  }
  </code></pre>
  
  <p>I still get this on my backend output <code>Forbidden (CSRF cookie not set.): /users/</code> and in the front end the classic <code>CSRF verification failed. Request aborted.</code></p>
  
  <p>Why wouldn't this work? Could it have something to do with the fact that I never manually set the CSRF cookie?</p>