Are you also passing back the cookie with the web request?  You need your POST to exactly match what a browser would do.  You can use the browser's developer tools to see what it sends.  Typically the most important things would be the cookies and the CSRF token (and of course the form body), but it's impossible to say that other headers aren't taken into account.  For instance, it wouldn't be out of the question for the user-agent string to be significant.  Only the author of the web application can tell you what it's using to validate requests.

I thought I was passing back everything. I used fiddler to check the back and forth and thought I had everything in place. Might be easier to show you in Long Beach.