fix: tests, only generate csrf_token on 404 gets

src/controllers/404.js

@@ -43,7 +43,11 @@ exports.send404 = async function (req, res) {
 	if (res.locals.isAPI) {
 		return res.json({ path: validator.escape(path.replace(/^\/api/, '')), title: '[[global:404.title]]' });
 	}
-	await middleware.applyCSRFasync(req, res);
+
+	if (req.method === 'GET') {
+		await middleware.applyCSRFasync(req, res);
+	}
+
 	await middleware.buildHeaderAsync(req, res);
 	res.render('404', { path: validator.escape(path), title: '[[global:404.title]]' });
 };