Bleh. I had the #webmentions route configured like my internal routes, so it was requiring a CSRF token. Should be fixed now.
But apparently I'm not displaying them correctly so still some work to do here.
There aren't any comments on this post yet. To comment, publish your reply online and send a webmention.