No worries, I'm certainly not "getting" the riddle myself. I tried md5sum'ing the response body and base64 encoding it and replacing the cookie's csrf.token val

No worries, I'm certainly not "getting" the riddle myself. I tried md5sum'ing the response body and base64 encoding it and replacing the cookie's csrf.token value with that, which didn't work (I did notice, however, that the server is accepting whatever you put in the cookie without re/over writing it). I tried POSTing and PUTing with data values like "csrf=valuefromcookie" and (this may seem stupid) "browser=seatgeek". I hand crafted a request using cURL. I also discovered their VHOST settings aren't quite right either because when you POST to https://apply.seatgeek.com https://apply.seatgeek.com it takes you straight to the homepage (instead of redirecting you to the http://apply.seatgeek.com http://apply.seatgeek.com page). Either way, kudos to those that got it in 15 minutes - I wasted far too much time chasing my tail on this one.