The Filelocker.request function automatically includes the required key for POST requests. But rather than using Filelocker.request, the .csv uploader for bulk users utilizes an external uploader (http://github.com/Valums-File-Uploader/file-uploader), and so the required key (requestOrigin) isn't sent along. A fix is to edit this javascript file: <filelocker_root>/static/js/admin.js Add requestOrigin as an additional parameter in the setParams function at line 1012. Now the POST data will include...