I'm guessing it's because biff/form adds a CSRF token--the 403 error is probably being thrown by ring.middleware.anti-forgery/wrap-anti-forgery. For debugging hints in general, when there's not anything useful in the terminal output, I often check the browser's network tab and inspect the request headers/body. e.g. in this case, if you compared the working request to one of the failed requests, maybe you'd see that the working one included a CSRF token. Might be worth having Biff throw a more specific error for this 🤷

I also discovered that I had an extra form being added by the ui element that did work, and when I added the outer form, I started getting a vector of two tokens. the error was confusing then too, but fortunately I had added a tap> to my own middleware