No slash, csrf exempt and ensure json serializer gets a dict, take two.

[timnbraun]

These changes allow me to use django_cap in my django based website. I'm not sure how it would have worked without them.

The slash redirect middleware in django didn't seem to retain the csrf token. If there's another way around this, let me know. Since the API is accessed by code on the same site, we can guard against cross-site contamination by setting the CAP_SITES_ENABLED appropriately.

The second commit turns off the CSRF token checking in the API views.

The third commit was needed since the Json response refused to accept the result dataclass as it didn't look like a dict. The one-line change forces the RedeemResult to become a dict() for serializing into a JsonResponse().

This fix may be a 'belt and suspenders' fix, but in my environment (vanilla django 6.0.4 startproject) all three commits were needed to avoid an error 400.

The previous pull request didn't include a version bump, and did have an error in the dict access of the dataclass in the redeem_challenge view.