Could not get CSRF token
An admin (or admin-design) client call to getAdminCsrf / getAdminDesignCsrf failed: GET /api/auth/csrf was not OK or returned no token.
Why this happens
Same endpoint as member CSRF, but this exact English string is thrown from admin helpers before PATCH/POST/DELETE. Typical causes: staff session expired, cookies blocked, proxy stripping the route, or the app not answering /api/auth/csrf.
Diagnose and fix
1. Sign out and back into Admin; hard-refresh the page.
2. Browser Network: /api/auth/csrf should be 200 with a token field.
3. Allow cookies; use the real HTTPS admin URL (not mixed http/https).
4. Sibling wording: Could not load CSRF token (other admin fetch helpers) and Could not load security token (upload/auth UI).