AjaxError «response failed verification» on modals when e.g. placing blocks

Apologies but I'm not sure how to reproduce this bug. It occurs on a Composer based Drupal 8.9 dev instance on Pantheon. I cannot reproduce these errors in my local environment.

The errors occur when I try to Place a block or Embed a media in a Wysiwyg editor field or want to Browse available tokens in the Pathauto admin UI. The modals don't load as expected. In the console I see errors like the following (this one when trying to embed a media image).

AjaxError:
An AJAX HTTP error occurred.
HTTP Result Code: 200
Debugging information follows.
Path: /media-library?media_library_opener_id=media_library.opener.editor&media_library_allowed_types%5B0%5D=image&media_library_allowed_types%5Baudio%5D=audio&media_library_allowed_types%5Bdocument%5D=document&media_library_allowed_types%5Bremote_video%5D=remote_video&media_library_allowed_types%5Bvideo%5D=video&media_library_selected_type=image&media_library_remaining=1&media_library_opener_parameters%5Bfilter_format_id%5D=full_html&hash=tx_2uZjQrTKMKLdeMB5udfRFqUkMxYXVUaLQvyZrDwE
StatusText: OK
CustomMessage: The response failed verification so will not be processed.
ResponseText: [{"command":"settings","settings":{"ajaxPageState":{"theme":"seven","theme_token":"cUuKE7ofRja52pYrFXcZmOwhPDF-0P3fMpNASDi3agc","libraries":"admin_toolbar\/toolbar.tree,admin_toolbar_tools\/toolbar.icon,big_pipe\/big_pipe,book\/drupal.book,ckeditor\/drupal.ckeditor,ckeditor\/drupal.ckeditor.plugins.drupalimagecapti…

The errors are coming from /core/misc/ajax.js:229-234. The section which I commented out below seems to be the cause of these errors.

success: function success(response, status, xmlhttprequest) {
  if (typeof response === 'string') {
    response = $.parseJSON(response);
  }
  /*if (response !== null && !drupalSettings.ajaxTrustedUrl[ajax.url]) {
    if (xmlhttprequest.getResponseHeader('X-Drupal-Ajax-Token') !== '1') {
      var customMessage = Drupal.t('The response failed verification so will not be processed.');
      return ajax.error(xmlhttprequest, ajax.url, customMessage);
    }
  }*/
  return ajax.success(response, status);
},