#434

backend/app/controllers/counts_exports_controller.rb

@@ -3,7 +3,9 @@ class CountsExportsController < ApplicationController
 
   def index
     locale = resolve_locale!
-    exporter = CountsExporter.new(request.request_parameters.merge(request.query_parameters),
+    payload = request.request_parameters.except('authenticity_token')
+        .merge(request.query_parameters)
+    exporter = CountsExporter.new(payload,
                                   language_code: locale.language_code)
     response.headers['Content-Type'] = exporter.format == 'json' ?
         'application/json; charset=utf-8' : 'text/csv; charset=utf-8'
@@ -14,7 +16,7 @@ class CountsExportsController < ApplicationController
     # Rack::ETag otherwise materialises the response to calculate a digest.
     response.headers['Last-Modified'] = Time.current.httpdate
     self.response_body = exporter.body
-  rescue ArgumentError, TypeError, JSON::ParserError
+  rescue ArgumentError, TypeError, KeyError, JSON::ParserError
     head :bad_request
   end
 end