FatalThrowableError in VerifyCsrfToken.php on 2.3.0b

[Seegras]

Hi

I get an exception when trying to setup/upgrade. There is an old working polr 2.2.0 install. I did not touch the database, but moved the httpdocs out of the way.

Basically, I unzip, run composer install --no-dev -o which returns some errors which look irrelevant:
Package jeremeamia/superclosure is abandoned, you should avoid using it. Use opis/closure instead.
Package mtdowling/cron-expression is abandoned, you should avoid using it. Use dragonmantank/cron-expression instead.
Package phpoffice/phpexcel is abandoned, you should avoid using it. Use phpoffice/phpspreadsheet instead.
Generating optimized autoload files
Carbon 1 is deprecated, see how to migrate to Carbon 2.
https://carbon.nesbot.com/docs/#api-carbon-2
You can run './vendor/bin/upgrade-carbon' to get help in updating carbon and other frameworks and libraries that depend on it.
Then I copy .env.setup to .env and chown everything to the php-user

And then try to use /setup. That works, but on submit it throws some error like this:

in FileSessionHandler.php line 41
at FileSessionHandler->__construct(object(Filesystem), 'httpdocs/storage/framework/sessions') in SessionManager.php line 62
at SessionManager->createNativeDriver() in SessionManager.php line 50
at SessionManager->createFileDriver() in Manager.php line 87
at Manager->createDriver('file') in Manager.php line 63
at Manager->driver() in StartSession.php line 115
at StartSession->getSession(object(Request)) in StartSession.php line 100
at StartSession->startSession(object(Request)) in StartSession.php line 57
at StartSession->handle(object(Request), object(Closure))
at call_user_func_array(array(object(StartSession), 'handle'), array(object(Request), object(Closure))) in Pipeline.php line 124
at Pipeline->Illuminate\Pipeline{closure}(object(Request)) in EncryptCookies.php line 59
at EncryptCookies->handle(object(Request), object(Closure))
at call_user_func_array(array(object(EncryptCookies), 'handle'), array(object(Request), object(Closure))) in Pipeline.php line 124
at Pipeline->Illuminate\Pipeline{closure}(object(Request))
at call_user_func(object(Closure), object(Request)) in Pipeline.php line 102
at Pipeline->then(object(Closure)) in Application.php line 1439
at Application->sendThroughPipeline(array('Illuminate\Cookie\Middleware\EncryptCookies', 'Illuminate\Session\Middleware\StartSession', 'Illuminate\View\Middleware\ShareErrorsFromSession', 'App\Http\Middleware\VerifyCsrfToken'), object(Closure)) in Application.php line 1213
at Application->dispatch(null) in Application.php line 1153
at Application->run() in index.php line 28

If I just copy in my old .env and run /login, on submit it throws:

FatalThrowableError in VerifyCsrfToken.php line 63:
Class 'Symfony\Component\Security\Core\Util\StringUtils' not found
in VerifyCsrfToken.php line 63
at VerifyCsrfToken->tokensMatch(object(Request)) in VerifyCsrfToken.php line 42
at VerifyCsrfToken->handle(object(Request), object(Closure)) in VerifyCsrfToken.php line 20
at VerifyCsrfToken->handle(object(Request), object(Closure))
at call_user_func_array(array(object(VerifyCsrfToken), 'handle'), array(object(Request), object(Closure))) in Pipeline.php line 124
at Pipeline->Illuminate\Pipeline{closure}(object(Request)) in ShareErrorsFromSession.php line 49
at ShareErrorsFromSession->handle(object(Request), object(Closure))
at call_user_func_array(array(object(ShareErrorsFromSession), 'handle'), array(object(Request), object(Closure))) in Pipeline.php line 124
at Pipeline->Illuminate\Pipeline{closure}(object(Request)) in StartSession.php line 62
at StartSession->handle(object(Request), object(Closure))
at call_user_func_array(array(object(StartSession), 'handle'), array(object(Request), object(Closure))) in Pipeline.php line 124
at Pipeline->Illuminate\Pipeline{closure}(object(Request)) in EncryptCookies.php line 59
at EncryptCookies->handle(object(Request), object(Closure))
at call_user_func_array(array(object(EncryptCookies), 'handle'), array(object(Request), object(Closure))) in Pipeline.php line 124
at Pipeline->Illuminate\Pipeline{closure}(object(Request))
at call_user_func(object(Closure), object(Request)) in Pipeline.php line 102
at Pipeline->then(object(Closure)) in Application.php line 1439
at Application->sendThroughPipeline(array('Illuminate\Cookie\Middleware\EncryptCookies', 'Illuminate\Session\Middleware\StartSession', 'Illuminate\View\Middleware\ShareErrorsFromSession', 'App\Http\Middleware\VerifyCsrfToken'), object(Closure)) in Application.php line 1213
at Application->dispatch(null) in Application.php line 1153
at Application->run() in index.php line 28

(apparently that StringUtils is to be removed: https://github.com/symfony/security/blob/2.8/Core/Util/StringUtils.php#L14)

php is 7.2.24-0ubuntu0.18.04.8