Update: we just deployed a fix for this, thanks for reporting! (We recently enabled Cloudflare caching which exposed a pre-existing CSRF issue, now fixed)