ActionController::InvalidAuthenticityToken on sign-in failure

Rails 8.1.2 Ruby 3.3.6 Devise 4.9.4

Behaviour

When providing a wrong password on login the application throws a ActionController::InvalidAuthenticityToken exception.

Expected

Show errors in the form

Details

Request Parameters:

{"authenticity_token"=>"[FILTERED]", "account"=>{"email"=>"[FILTERED]", "password"=>"[FILTERED]", "remember_me"=>"0"}, "commit"=>"Log in", "locale"=>"de"}`

Tried

• disabled unpoly (removed up-main and up up-viewport)
• tried #5698
• config.clean_up_csrf_token_on_authentication = false