{{-- Every script in this layout that posts with fetch() reads its CSRF token from here, the way the admin layout has always done (admin/layouts/app.blade.php:6). It was never added here, so those requests sent an empty token and were refused with a 419 — including the card payment form the Stripe module renders on an invoice, which reads exactly this tag and has been unable to take a payment in the client area. --}}