GET to set the ``csrftoken`` cookie before unsafe requests from the SPA.

GET /api/auth/csrf/?format=api
HTTP 200 OK
Allow: GET, HEAD, OPTIONS
Content-Type: application/json
Vary: Accept

{
    "detail": "ok",
    "csrfToken": "ChztITrxFf6emDUBgNzNpSRxJIWaSKAYAGedUr13Mhee1mTWypLauhnGHBuHgBpV"
}