No CSRF for unlogged forms

picampaign/feedback/views.py

+import json
+
+from django.views.decorators.csrf import csrf_exempt
 from rest_framework import viewsets
 from rest_framework.response import Response
 
@@ -11,9 +14,9 @@ class FeedbackViewSet(viewsets.ViewSet):
     queryset = Feedback.objects.all()
     serializer_class = FeedbackSerializer
 
+    @csrf_exempt
     def create(self, request, campaign_pk=None):
         serializer = FeedbackSerializer(data=request.data)
         serializer.is_valid()
-        print(serializer.validated_data)
-        feedback = Feedback.objects.create(callee=serializer.validated_data.pop('callee'), **serializer.validated_data)
+        feedback = serializer.create(serializer.validated_data)
         return Response(feedback.id)

picampaign/urls.py

+from django.conf import settings
 from django.conf.urls import include, url
 from django.contrib import admin
 from rest_framework_nested import routers
@@ -28,3 +29,9 @@ urlpatterns = [
        url(r'^', include(campaign_router.urls)),
        url(r'^i18n/', include('django.conf.urls.i18n'))
     ]
+
+if settings.DEBUG:
+    import debug_toolbar
+    urlpatterns += [
+            url(r'^__debug__/', include(debug_toolbar.urls)),
+            ]