django ajax post 403 forbidden

à l'aide de django 1.4 im obtenir une erreur 403 quand j'ai essayer de faire un post de mon javascript ne mon django serveur. mes fonctionne très bien mais le problème est qu'avec la poste. aussi essayé @csrf_exempt avec pas de chance

Mise à JOUR: je peux Poster maintenant que j'ai ajouté {% csrf_token %} , mais le post l'intervention est vide, bien que le GET est livré correctement, des idées?

mon django vue:

@csrf_protect
def edit_city(request,username):
    conditions = dict()

    #if request.is_ajax():
    if request.method == 'GET':
        conditions = request.method

    elif request.method == 'POST':
        print "TIPO" , request.GET.get('type','')       
        #based on http://stackoverflow.com/a/3634778/977622     
        for filter_key, form_key in (('type',  'type'), ('city', 'city'), ('pois', 'pois'), ('poisdelete', 'poisdelete'), ('kmz', 'kmz'), ('kmzdelete', 'kmzdelete'), ('limits', 'limits'), ('limitsdelete', 'limitsdelete'), ('area_name', 'area_name'), ('action', 'action')):
            value = request.GET.get(form_key, None)
            if value:
                conditions[filter_key] = value
                print filter_key , conditions[filter_key]

        #Test.objects.filter(**conditions)
    city_json = json.dumps(conditions)

    return HttpResponse(city_json, mimetype='application/json')

voici mon code javascript :

function getCookie(name) {
var cookieValue = null;
if (document.cookie && document.cookie != '') {
var cookies = document.cookie.split(';');
for (var i = 0; i < cookies.length; i++) {
var cookie = jQuery.trim(cookies[i]);
//Does this cookie string begin with the name we want?
if (cookie.substring(0, name.length + 1) == (name + '=')) {
cookieValue = decodeURIComponent(cookie.substring(name.length + 1));
break;
}
}
}
return cookieValue;
}
var csrftoken = getCookie('csrftoken');
function csrfSafeMethod(method) {
//these HTTP methods do not require CSRF protection
return (/^(GET|HEAD|OPTIONS|TRACE)$/.test(method));
}
function sameOrigin(url) {
//test that a given url is a same-origin URL
//url could be relative or scheme relative or absolute
var host = document.location.host; //host + port
var protocol = document.location.protocol;
var sr_origin = '//' + host;
var origin = protocol + sr_origin;
//Allow absolute or scheme relative URLs to same origin
return (url == origin || url.slice(0, origin.length + 1) == origin + '/') ||
(url == sr_origin || url.slice(0, sr_origin.length + 1) == sr_origin + '/') ||
//or any other URL that isn't scheme relative or absolute i.e relative.
!(/^(\/\/|http:|https:).*/.test(url));
}
$.ajaxSetup({
beforeSend: function(xhr, settings) {
if (!(/^http:.*/.test(settings.url) || /^https:.*/.test(settings.url))) {
//Only send the token to relative URLs i.e. locally.
xhr.setRequestHeader("X-CSRFToken",
$('input[name="csrfmiddlewaretoken"]').val());
}
}
});
$.post(url,{ type : type , city: cityStr, pois: poisStr, poisdelete: poisDeleteStr, kmz: kmzStr,kmzdelete : kmzDeleteStr,limits : limitsStr, area_nameStr : area_nameStr , limitsdelete : limitsDeleteStr},function(data,status){
alert("Data: " + data + "\nStatus: " + status);
console.log("newdata" + data.area_name)
});

j'ai aussi essayé de le site avec pas de chance :

$.ajaxSetup({
beforeSend: function(xhr, settings) {
if (!csrfSafeMethod(settings.type) && sameOrigin(settings.url)) {
//Send the token to same-origin, relative URLs only.
//Send the token only if the method warrants CSRF protection
//Using the CSRFToken value acquired earlier
xhr.setRequestHeader("X-CSRFToken", csrftoken);
}
}
});

ce qui me manque?