Manager: deleting an element from the list shows "session token has changed or is missing" (GET delete action returns 403 without _token) #2525

In the Manager, clicking the trash icon next to a template / chunk / snippet / plugin / TV in the elements list shows the message below, even though [the element is actually deleted – please confirm]:

The session token has changed or is missing. Reopen the manager, then review and retry your action. The action was not performed.

The message appears every time. After pressing F5 the Manager works normally. Deleting the same element from inside its own edit page (Delete button) works without any message.

Environment

• Evolution CMS: 3.5.8 / 3.5.9
• PHP: 8.3.36 and 8.5.12

Steps to reproduce

1. Log in to the Manager.
2. Open the elements list (e.g. Templates).
3. Click the trash icon next to any item.
4. The message above is displayed.

What I see in the network tab

The delete is sent as a legacy GET request with no _token parameter, and the response is 403:

GET /manager/?a=303&id=4   → 403
GET /manager/?a=21&id=6    → 403

After that the Manager requests /manager/media/style/default/ajax.php (200).