fix: CSRF flow ships the raw token, not the HMAC cookie

tests/Integration/PostStartMatchTest.php

@@ -29,7 +29,7 @@ final class PostStartMatchTest extends TestCase
         $request = $this->buildRequest(
             rawBody: json_encode($this->validScenario(), JSON_THROW_ON_ERROR),
             csrfHeader: $token,
-            cookies: ['__csrf' => $cookie],
+            cookies: ['__csrf' => $cookie, '__csrf_token' => $token],
         );
         $response = $handler->handle($request, ['id' => 'demo']);
 
@@ -51,7 +51,7 @@ final class PostStartMatchTest extends TestCase
         $request = $this->buildRequest(
             rawBody: json_encode(['this' => 'is not a valid scenario'], JSON_THROW_ON_ERROR),
             csrfHeader: $token,
-            cookies: ['__csrf' => $cookie],
+            cookies: ['__csrf' => $cookie, '__csrf_token' => $token],
         );
         $response = $handler->handle($request, ['id' => 'demo']);
 
@@ -65,7 +65,7 @@ final class PostStartMatchTest extends TestCase
         $request = $this->buildRequest(
             rawBody: json_encode($this->validScenario(), JSON_THROW_ON_ERROR),
             csrfHeader: $token,
-            cookies: ['__csrf' => $cookie],
+            cookies: ['__csrf' => $cookie, '__csrf_token' => $token],
         );
         $response = $handler->handle($request, ['id' => 'demo']);