Right. Can I see the frontend and backend config please? Cause you shouldn't be requiring anti-csrf tokens if the domains are the same.