- Add csrf_token parameter to fetch() body - CodeIgniter 4 CSRF filter requires token in POST body, not just headers