That sounds like the issue. You should be able to get around it by enabling disabling the discourse_connect_csrf_protection site setting. It’s a hidden site setting, set to true by default. You’ll need to enable it from the Rails console.
It’s used in the code here: