Bleh. I had the #webmentions route configured like my internal routes, so it was requiring a CSRF token. Should be fixed now.

But apparently I'm not displaying them correctly so still some work to do here.