title: "invalid CSRF (Cross Site Request Forgery) token" on some routes
body: <p>I get this error when submitting a form. The form does have a hidden _csrf_token field, as can be seen in the screenshot below:</p>
  
  <p><a href="https://i.stack.imgur.com/m1tDo.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/m1tDo.png" alt="enter image description here"></a></p>
  
  <p>However, when it is submitted, the token fails validation:</p>
  
  <pre><code>[debug] ** (Plug.CSRFProtection.InvalidCSRFTokenError) invalid CSRF (Cross Site Request 
  Forgery) token, make sure all requests include a valid '_csrf_token' param or 
  'x-csrf-token' header
      (plug) lib/plug/csrf_protection.ex:233: Plug.CSRFProtection.call/2
  </code></pre>
  
  <p>My code is pretty standard:</p>
  
  <p><strong>router.ex</strong></p>
  
  <pre><code>scope "/account" do
    pipe_through :browser
  
    get "/redeem/:token", MyAppWeb.Accounts.AccountController, :verify_invitation
    post "/redeem", MyAppWeb.Accounts.AccountController, :redeem_invitation
  end
  </code></pre>
  
  <p><strong>account_controller.ex</strong></p>
  
  <pre><code>#renders the form
  def verify_invitation(conn, %{"token" =&gt; token}) do
    conn
    |&gt; put_status(:ok)
    |&gt; put_flash(:info, "Invitation verified. Please choose a password.")
    |&gt; put_view(MyAppWeb.Accounts.AccountView)
    |&gt; render("redeem.html", invitation: invitation)
  end
  
  #simplified
  def redeem_invitation(conn, %{"token" =&gt; token, "user" =&gt; %{"password" =&gt; password, "password_confirmation" =&gt; password_confirmation}}) do
    conn
    |&gt; redirect(external: MyAppWeb.Router.Helpers.login_page_url(conn, MyAppWeb.Endpoint, :new) &lt;&gt; "?action=redeem")
  end
  </code></pre>
  
  <p><strong>redeem.html.eex</strong></p>
  
  <pre><code>&lt;%= form_for @conn, redeem_invitation_path(@conn, :redeem_invitation), fn f -&gt; %&gt;
  
    # stuff
  
    &lt;%= submit "Create Account", class: "btn btn-indigo ml-0" %&gt;
  
  &lt;% end %&gt;
  </code></pre>
  
  <p>Why is the CSRF token failing to validate?</p>