allowing auth backends to csrf_exempt a view

### Code of Conduct

- [x] I agree to follow Django's Code of Conduct

### Feature Description

following #193 , to make Django's authentication system more extendible, we could consider allowing authentication backends to exempt a view from csrf, this is useful when a view is authenticed using tokens or other methods that don't require csrf

drf implements something similar to this idea

### Problem

depending on how users are authenticed and what the client is, we might need to manually exempt a lot of views from csrf check
we could simplify the process by handling that in auth level, where we know exactly how a request was authenticated

### Request or proposal

proposal

### Additional Details

_No response_

### Implementation Suggestions

_No response_

Start by reading related issue #193 and the referenced DRF behavior, then investigate Django's authentication and CSRF integration points to define the proposal's scope. Done would require an agreed design for how an authentication backend can exempt a view, including its security implications and expected behavior.

Written by the indexing model from the issue text.