AJAX errors after more than two requests in a row

Problem/Motivation

We have been using Views flag Refresh for a long time now without any obvious issues.

1. We use View Flag Refresh to refresh the dialog box that contains an AJAX-powered View.
2. We use the Views Flag Refresh setting in the that named view to refresh the view.

You can see below in the GIF animation to remove items from the list...

What is baffling us is that we have no problem when running the site locally but on the hosted version, if we click more than two buttons, refreshing fails and we hit an error relating to CSRF.

Basically, in a dialog box as in the one above:

We can click the first flag - SUCCESS.
We can click the second flag - SUCCESS.

But any further clicks on the Flag links we are seeing a Console error...

Object { message: '\nAn AJAX HTTP error occurred.\nHTTP Result Code: 403\nDebugging information follows.\nPath: /flag/unflag/my_homework_list/8449/default?destination=/my-homework-list&token=KBTRugiEws1Q1zX3p0DwGvRuoBlV0WjuyZq5jWwM4TY\nStatusText: error\nResponseText: {"message":"\\u0027csrf_token\\u0027 URL query argument is invalid."}', name: "AjaxError", stack: "@https://bit-by-bit.org/core/misc/ajax.js?v=10.4.1:196:32\n@https://bit-by-bit.org/core/misc/ajax.js?v=10.4.1:1935:3\n" }
​
message: '\nAn AJAX HTTP error occurred.\nHTTP Result Code: 403\nDebugging information follows.\nPath: /flag/unflag/my_homework_list/8449/default?destination=/my-homework-list&token=KBTRugiEws1Q1zX3p0DwGvRuoBlV0WjuyZq5jWwM4TY\nStatusText: error\nResponseText: {"message":"\\u0027csrf_token\\u0027 URL query argument is invalid."}'
​
name: "AjaxError"
​
stack: "@https://bit-by-bit.org/core/misc/ajax.js?v=10.4.1:196:32\n@https://bit-by-bit.org/core/misc/ajax.js?v=10.4.1:1935:3\n"

Very odd, and it's ALWAYS the third flag where it starts!

Once again, running this locally in a Windows MAMP PRO stack, we can click any number of Flag links and everything works perfectly fine.

Can anyone offer any ideas as to what on earth might be causing this behaviour?

We have had extensive conversations with the hosting provider and definitely reached the conclusion that it is not a 'hosting issue'.

Thanks everyone.