Basically you can't ever confirm the code of conduct right now as it results in a 403. Needs CSRF token.