About CSRF Tokens

CSRF tokens are based on a random secret value. When validating the CSRF token field value, not the full token, but only the secret is compared with the secret in the cookie value or the session. This allows developers to use tokens that change for different requests, e.g. within each Ajax call.

However, it is important to note, that each login invalidates previously valid CSRF tokens and their secrets. So if you do login by an API call, make sure to refresh the tokens in the main page.