The bug was caused by the switch to Rails UJS in
https://gitlab.com/gitlab-org/gitlab/-/merge_requests/27394.

The form wasn't submitted remotely and the CSRF token wasn't sent.

We also enable CSRF protection for JS tests to catch these problems.