Figured it out ! … No need for :443 …
'csrf.optout' => array ( ... 4 => '/Nextcloud-android/', ),