Exercise "Web Server Brute Force Authentication: Anti-CSRF Tokens" broken?

Is this training really working? Every interaction with the page "Immersive Airport Display Management Systems" displays "csrf token is invalid". From the briefing it sounds all doable, do a get, get the token, send it in the post in a loop with the passwords. But it doesn't work for me at all.