also missing a `<meta name="X-CSRF-Token" content="...">`