Handlers don't work from remote services

From a developer:

[quote]
All the handlers I am creating that are accessed by remote tools using POST requests (settings service, outcomes service and memberships service) are all blocked by django's CSRF protection. Adding the @csrf_exempt decorator to the handlers in the XBlock has no effect. I have only been able to get it working by adding @csrf_exempt to the handler function in workbench/views.py

diff --git a/workbench/views.py b/workbench/views.py
index b8f97e6..72037a5 100644
--- a/workbench/views.py
+++ b/workbench/views.py@@ -75,7 +76,9 @@ def show_scenario(request, scenario_id, view_name='student_view'):
})

+from django.views.decorators.csrf import csrf_exempt
+@csrf_exempt
def handler(request, usage_id, handler_slug):
student_id = get_student_id(request)
log.info("Start handler %s/%s for student %s", usage_id, handler_slug, student_id)
usage = Usage.find_usage(usage_id)

[end quote]

Clearly, we don't want to exempt all handlers from CSRF protection, so we need a way to indicate which handlers are from the authenticated browser, and which are not.

Start in workbench/views.py at the handler function and trace how XBlock handlers receive POST requests and how the CSRF exemption is applied. Compare handlers accessed by authenticated browsers with those used by the settings, outcomes, and memberships services. Done means the issue's requested distinction is supported without exempting every handler, with behavior covered by relevant tests if they exist.