was trying to get the tunnel based on the csrf-token header which is wrong. So try all possible token formats