the point of removing subdomain boxing is to allow any of our pages to communicate with the route. This will not work if removing the default subdomain box causes a different CSRF token to be used