diff --git a/spec/dummy/config/environments/test.rb b/spec/dummy/config/environments/test.rb
index <HASH>..<HASH> 100644
--- a/spec/dummy/config/environments/test.rb
+++ b/spec/dummy/config/environments/test.rb
@@ -30,7 +30,7 @@ Rails.application.configure do
   config.action_dispatch.show_exceptions = false
 
   # Disable request forgery protection in test environment.
-  config.action_controller.allow_forgery_protection = false
+  config.action_controller.allow_forgery_protection = true
 
   config.action_mailer.perform_caching = false
 
diff --git a/spec/features/admin/legacy_page_url_management_spec.rb b/spec/features/admin/legacy_page_url_management_spec.rb
index <HASH>..<HASH> 100644
--- a/spec/features/admin/legacy_page_url_management_spec.rb
+++ b/spec/features/admin/legacy_page_url_management_spec.rb
@@ -11,7 +11,8 @@ RSpec.describe "Legacy page url management", type: :system, js: true do
 
   def open_page_properties
     visit admin_pages_path
-    page.find("a[href='#{configure_admin_page_path(a_page)}']").click
+    expect(page).to have_no_css(".spinner")
+    page.find("a[href='#{configure_admin_page_path(a_page)}']", wait: 10).click
   end
 
   it "lets a user add a page link" do
fix admin sitemap feature specs

Enable forgery protection so we have a csrf-token in the dom that our ajax lib
expects.

Also wait for the sitemap spinner to disappear
before acting with the dom with capybara