Delphi IdHTTP Django-generated form post

I am posting login data from delphi to django-created-form which runs on my localhost. Like this:

procedure TForm1.btnPostClick(Sender: TObject);
var
  IdHTTP: TidHTTP;
  auth: TStringList;
  test,token:string;
begin
  IdHTTP := TidHTTP.Create(nil);
  IdHTTP.Request.Accept         :='text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8';
  IdHTTP.Request.AcceptCharSet  :='iso-8859-1, utf-8, utf-16, *;q=0.1';
  IdHTTP.Request.AcceptEncoding :='deflate, gzip, identity, *;q=0';
  IdHTTP.Request.Connection     :='Keep-Alive';
  IdHTTP.Request.ContentType    :='application/x-www-form-urlencoded';

  token := IdHTTP.Get('http://localhost:8000/accounts/signup/');
  token := copy(token, AnsiPos('csrfmiddlewaretoken', token) + 28, 32);

  IdHTTP.Request.CustomHeaders.Clear;
  with IdHTTP.Request.CustomHeaders do
  begin
    AddValue('X-CSRFToken',token);
    Values['COOKIE']:='';
    //if IdHTTP2.CookieManager.CookieCollection.count > 0 then
    //  Add('COOKIE: '+token);
  end;

  try
    auth := TStringList.Create;
    auth.Add('csrfmiddlewaretoken='+ token);
    auth.Add('first_name=' + edtVorname.Text);
    auth.Add('last_name=' + edtName.Text);
    auth.Add('function=' + edtFunction.Text);
    auth.Add('company=' + edtCompany.Text);
    auth.Add('country=' + edtCountry.Text);
    auth.Add('email=' + edtEmail.Text);
    auth.Add('password1=' + edtPassword.Text);
    auth.Add('password2=' + edtPasswordAgain.Text);

    //IdHTTP.Request.CustomHeaders.AddValue('Accept-Language', 'en-EN');
    //IdHTTP.Request.CustomHeaders.AddValue('Referer',
    IdHTTP.post('http://127.0.0.1:8000/accounts/signup/', auth);
  except
  end;
end;

      

        
        
        
      

    

Whenever it comes to the line with the message

 IdHTTP.post('http://127.0.0.1:8000/accounts/signup/', auth);

      

        
        
        
      

    

Im getting a 403 Forbidden error. I am guessing that I sent the CSRF token incorrectly because from the python debugger I see a hit in

 if csrf_token is None:
            # No CSRF cookie. For POST requests, we insist on a CSRF cookie,
            # and in this way we can avoid all CSRF attacks, including login
            # CSRF.
            return self._reject(request, REASON_NO_CSRF_COOKIE)

      

        
        
        
      

    

But HOW should it be? How do I send this csrf token?

PS Well I guess the problem is that the default for the parameter is HandleRedirects

set to a value True

and that gave me 403. Cooking in recent versions of Django is usually called csrftoken

, not X-CSRFToken

how I did it here.