When targetType is configured (data binding is used), a 403 Forbidden response is returned as an http:ClientRequestError instead of an http:Response.
The current isCSRFTokenFailure implementation only checks if the result is an http:Response. As a result, CSRF failures occurring during requests with data binding are not detected, and the automatic token refresh retry logic is not triggered.