GAE blobstore upload fails with CSRF token missing
Okey, so the real problem was that I was giving an absolute url to the successpath  argument (i.e. the first) of blobstore.create_upload_url(), causing the request notifying about the success caused a csrf error when loading the root path (/). I changed it to a path relative to the root and now just using @csrf.exempt as normal works fine.
I'm running flask on app engine. I need to let users upload some files. For security reasons I have csrf = CsrfProtect(app) on the whole app, with specific url's exempted using the @csrf.exempt decorator in flask_wtf. (Better to implicitly deny than to implicitly allow.)
Getting an upload url from blobstore with blobstore.create_upload_url works fine, but the upload itself fails with a 400; CSRF token missing or incorrect.
This problem is on the development server. I have not tested it on the real server, since it is in production.
How do I exempt the /_ah/ path so the uploads work?