was trying to get the tunnel based on the csrf-token header which is wrong. So...

See merge request !82