CSRF check failing

On NC18, when I try to start a video conference, it

a) doesnā€™t work in Chrome
b) sort of works in Edge, but I never get audio or video

When I look in the Console, is see this:

HTTP404: NOT FOUND - The server has not found anything matching the requested URI (Uniform Resource Identifier).
(XHR)GET - https://nextcloud.mydomain.com/ocs/v2.php/apps/spreed/api/v1/signaling/ode8o2t9
Stop pulling messages after repeated failures

[ā€¦]

CSP14309: Unknown directive ā€˜manifest-srcā€™ in Content-Security-Policy - directive will be ignored.
Joining call

[ā€¦]

HTTP404: NOT FOUND - The server has not found anything matching the requested URI (Uniform Resource Identifier). (XHR)DELETE - https://nextcloud.mydomain.com/ocs/v2.php/apps/spreed/api/v1/call/ode8o2t9
Unhandled promise rejection Error

If I go to the URI in my browser, I see this:

Access forbidden
CSRF check failed

I imagine itā€™s a security configuration on my Apache server, but Iā€™m not sure which one it is. Or maybe not, I donā€™t know.

Any ideas what could be causing this?