[1.3.X] Refs #15855 -- Recommended the csrf_protect decorator rather than...

all other middleware).

However, if you use cache decorators on individual views, the CSRF middleware

will not yet have been able to set the Vary header.  In this case, on any views

that will require a CSRF token to be inserted you should use the

:func:`django.views.decorators.vary.vary_on_cookie` decorator first::

will not yet have been able to set the Vary header or the CSRF cookie, and the

response will be cached without either one. In this case, on any views that

will require a CSRF token to be inserted you should use the

:func:`django.views.decorators.csrf.csrf_protect` decorator first::

  from django.views.decorators.cache import cache_page

  from django.views.decorators.vary import vary_on_cookie

  from django.views.decorators.csrf import csrf_protect

  @cache_page(60 * 15)

  @vary_on_cookie

  @csrf_protect

  def my_view(request):

      # ...