The AuditLogModel was being instantiated without required $conn parameter when logging CSRF failures, causing a 500 error. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>