*edit* this should be fixed now

Thanks for providing a bit more info into this. Looks like there's bug with csrf token when used without credentials. I'll fix this later today.