title: How can I disable Django's csrf protection only in certain cases?
body: <p>I'm trying to write a site in Django where the API URLs are the same as user-facing URLs.  But I'm having trouble with pages which use POST requests and CSRF protection.  For example, if I have a page /foo/add I want to be able to send POST requests to it in two ways:</p>
  
  <ol>
  <li>As an end user (authenticated using a session cookie) submitting a form.  This requires CSRF protection.</li>
  <li>As an API client (authenticated using a HTTP request header).  This will fail if CSRF protection is enabled.</li>
  </ol>
  
  <p>I have found various ways of disabling CSRF, such as @csrf_exempt, but these all disable it for the entire view.  Is there any way of enabling/disabling it at a more fine-grained level?  Or am I just going to have to implement by own CSRF protection from scratch?</p>