Still confused. It sends the csrf token now, no dice.