Security token not ready — refresh the page and try again
Login, register, resend verification, contact, and similar forms refuse submit when the CSRF token is still empty (auth.csrfNotReady).
Why this happens
GET /api/auth/csrf has not finished or failed; user submitted too early, or cookies blocked. Sibling of shorter Refresh the page and try again and of load-failure Could not load security token — refresh the page.
Diagnose and fix
1. Wait a moment after page load, or hard refresh; retry.
2. Allow cookies; use HTTPS on the real site URL.
3. Network: /api/auth/csrf should return 200 + token.
4. If POST still fails with 403, see Invalid CSRF token.