Authentication Not Performed via x-csrf-token.

Hi, I have checked with two different condition

1. Without Grant permission to anonymous users for "Webform Submit POST"

 curl -X POST -H "Content-Type: application/json" -H "X-CSRF-Token:gtoonH1Rj0gtCJzmOLW-6E1KkWe6ldb5KgDRgz97z5A" -d '{"webform_id": "inquiry", "name": "demo name", email="demo@gmail.com"}' http://lando-d10.lndo.site:8000/webform_rest/submit
{"message":"The \u0027restful post webform_rest_submit\u0027 permission is required."}

For make post request you need to pass cookie also with `x-csrf-token`

curl --location 'http://lando-d10.lndo.site:8000/webform_rest/submit?_format=json' \
--header 'Content-Type: application/json' \
--header 'X-CSRF-TOKEN: gtoonH1Rj0gtCJzmOLW-6E1KkWe6ldb5KgDRgz97z5A' \
--header 'Cookie: SESS93092389ae524832432597fba32d9747=boHyZiQHKHMPSZfQpvt6esNA0xApZhn2fQqvttTVJ678dePs' \
--data-raw '{
   "webform_id": "inquiry",
    "email": "demo@gmail.com",
    "name": "demo name",
}'

2. After grant permission to anonymous users you can submit post request but it will not validate `x-csrf-token` any more.

I'm seeing a similar issue that's equally puzzling.

It's a GET request to webform_rest/WEBFORMID/elements, using basic_auth with a user account that has the "restful get webform_rest_elements" permission, the API request returns a 403 with the message "The 'restful get webform_rest_elements' permission is required." However, looking at dblog I see a message for the 403 reaction but it shows the user was logged in, the API failure was not for the anonymous user!

In the end I deleted the user account and recreated it - same credentials, same role, and it worked. So something was borked somewhere.