Good point. I originally did not return the XHR object because `post` was taking care of fetching the CSRF token, which resulted in 2 requests. That is now taken care of in network, meaning `post` can safely return the object.