comment the csrf middleware replacement

class ApiKeyCsrfViewMiddleware(CsrfViewMiddleware):

    """Allow API-key clients to authenticate without also supplying a CSRF token."""

    def process_view(

        self, request: HttpRequest, callback, callback_args, callback_kwargs

    ):

        if (

            # CSRF only protects unsafe methods; safe methods should keep Django's

            # normal short path and csrf_exempt views should remain fully exempt.

            request.method not in ("GET", "HEAD", "OPTIONS", "TRACE")

            and not getattr(callback, "csrf_exempt", False)

            # A valid API key proves the caller is not relying on browser cookies,

            # so CSRF protection would only block legitimate non-browser clients.

            and self._request_has_active_api_key(request)

        ):

            return self._accept(request)

        api_key = request.headers.get("X-Api-Key")

        if not api_key:

            return False

        # Compare the stored hash instead of the raw key; the database never needs

        # to contain recoverable API-key material.

        return APIKey.objects.filter(

            key_hash=APIKey.hash_key(api_key),

            active=True,