Editing deserialized object variable on process instance produces error

When trying to edit an object variable of a process instance in Camunda Cockpit, the X-XSRF-TOKEN header is not send in the post request, which results in a 500 Internal Server Error, the variable not getting changed and getting logged out.

Reproduce:

1. Go to a running process instance in Camunda Cockpit
2. Click on the Value of an Variable that is of the type Object
3. In the now open Form go to the Deserialized tab and change the value there.
4. Click the Change Button.

After that you see the error that the variable could not be changed successfully, and after you try to navigate to somewhere else you get redirected to the login page.

java.lang.IllegalStateException: Cannot create a session after the response has been committed
org.apache.catalina.connector.Request.doGetSession(Request.java:2955)
org.apache.catalina.connector.Request.getSession(Request.java:2325)
org.apache.catalina.connector.RequestFacade.getSession(RequestFacade.java:895)
org.apache.catalina.connector.RequestFacade.getSession(RequestFacade.java:907)
org.camunda.bpm.webapp.impl.security.auth.AuthenticationFilter.doFilter(AuthenticationFilter.java:68)

All other POST requests work as expected and have the header "X-XSRF-TOKEN" included in the request (Like the request sent when changing a simple property, like String or Long).