Explicitly exclude the API subdomain from CSRF checks

TODO: Do this properly!

1 files changed, 3 insertions, 3 deletions

diff --git a/pysite/route_manager.py b/pysite/route_manager.py
index 18efbf73..03587fb0 100644
--- a/pysite/route_manager.py
+++ b/pysite/route_manager.py
@@ -69,12 +69,12 @@ class RouteManager:
                 self.log.debug(f"Loading Blueprint: {sub_blueprint.name}")
                 self.load_views(sub_blueprint, f"pysite/views/{sub}")
                 self.app.register_blueprint(sub_blueprint)
+
+                if sub == "api":
+                    CSRF.exempt(sub_blueprint)  # TODO: Gotta make this work properly, this is just a kludge for now
             except Exception:
                 logging.getLogger(__name__).exception(f"Failed to register blueprint for subdomain: {sub}")
 
-            # if sub == "api":
-            #     CSRF.exempt(sub_blueprint)
-
         # Load the websockets
         self.ws_blueprint = Blueprint("ws", __name__)