When the http csrf is default enabled, callbacks raises a http error 400: Invalid CSRF Token. Fixes #9065 Closes #9073