{"status":401,"message":"invalid csrf token"}

I had the same problem with JavaScript blocker enabled. It actually displayed exactly this JSON response in my browser. Do you use anything similar?