Could you add a quick "TODO" comment here, saying we need to figure out why this is happening, since the csrftoken *shouldn't* be different?