Quoting myself from 182134:
If wgMFPhotoUploadEndpoint isn't set, then you can't upload a photo locally.
When wgMFPhotoUploadEndpoint isn't set, the PhotoApi#save uses mw.Api.post (not postWithToken) to upload the photo and the upload API action requires a CSRF token.
ForeignApi is a useful abstraction but it isn't interchangeable with mw.Api in this situation.
… nor if you set wgMFPhotoUploadEndpoint to "http://127.0.0.1:8080/w/api.php".
This isn't a fire bucket task, as our production setup shouldn't trigger this behaviour.