Looking at this PR because of the discussion in Symfony, I'm wondering why you throw an InvalidArgumentException, which will render a 500 error page. A CSRF check failure is a 4xx error, not a 5xx one