X-XSRF-TOKEN is for Laravel's cookie-based CSRF verification, but this app uses meta tag CSRF. Main.vue uses X-CSRF-TOKEN and works correctly.