feat: Enhance security by adding @login_required to multiple views and replacing print statements with logger.debug

Co-authored-by: Copilot <copilot@github.com>

anatomy/views.py

@@ -1242,10 +1242,16 @@ def create_body_part(request):
     )
 
 
-@csrf_exempt
+@login_required
 def get_body_part_id(request):
-    if request.accepts("application/json")():
-        body_part_name = request.GET["body_part_name"]
+    """Return the primary key for a BodyPart looked up by name (admin popup helper).
+
+    Scope: authenticated users only.
+    Functionality: looks up a BodyPart by exact name and returns its ID as JSON;
+    used by inline admin form popups.
+    """
+    if request.accepts("application/json"):
+        body_part_name = request.GET.get("body_part_name", "")
         body_part_id = BodyPart.objects.get(name=body_part_name).id
         data = {
             "body_part_id": body_part_id,
@@ -1268,10 +1274,16 @@ def create_examination(request):
     )
 
 
-@csrf_exempt
+@login_required
 def get_examination_id(request):
-    if request.accepts("application/json")():
-        examination_name = request.GET["examination_name"]
+    """Return the primary key for an Examination looked up by name (admin popup helper).
+
+    Scope: authenticated users only.
+    Functionality: looks up an Examination by exact name and returns its ID as JSON;
+    used by inline admin form popups.
+    """
+    if request.accepts("application/json"):
+        examination_name = request.GET.get("examination_name", "")
         examination_id = Examination.objects.get(name=examination_name).id
         data = {
             "examination_id": examination_id,
@@ -1282,10 +1294,16 @@ def get_examination_id(request):
 
 
 
-@csrf_exempt
+@login_required
 def get_structure_id(request):
-    if request.accepts("application/json")():
-        structure_name = request.GET["structure_name"]
+    """Return the primary key for a Structure looked up by name (admin popup helper).
+
+    Scope: authenticated users only.
+    Functionality: looks up a Structure by exact name and returns its ID as JSON;
+    used by inline admin form popups.
+    """
+    if request.accepts("application/json"):
+        structure_name = request.GET.get("structure_name", "")
         structure_id = Structure.objects.get(name=structure_name).id
         data = {
             "structure_id": structure_id,