Found a policy that was changing the url of the requestor which caused the good_referrer to NOT match the request_referrer. It took a while to find it. We needed the WTF_CSRF_ENABLED set to true.