added setting and code to turn off extra CSRF checking for unsafe actions

rest_framework/compat.py

@@ -290,6 +290,12 @@ else:
                     )
                     return self._reject(request, REASON_NO_CSRF_COOKIE)
 
+                if hasattr(settings, 'REST_FRAMEWORK_EXTRA_CSRF'):
+                    extra_csrf = settings.REST_FRAMEWORK_EXTRA_CSRF
+                else:
+                    extra_csrf = True
+
+                if extra_csrf:
                     # check non-cookie token for match
                     request_csrf_token = ""
                     if request.method == "POST":