Also, change the meta tag to just `csrf-token`; it's not being used just for sso