You'll need to allow the CSRF token header here too