Upodates give "GET /core/authorize.php" 403

[joshuacox]

I get these errors in my logs when trying to do updates.

Error 403 Forbidden
Forbidden

Guru Meditation:
XID: 393228

Varnish cache server

I attempted to add this line to extraSettings:

  extraSettings:
    |-
    $settings['allow_authorize_operations'] = TRUE;

but does not seem to be catching. Is there something else that must be on for updates to work?

EDIT: possibly this is only expected to be done from CLI?

composer update drush/drush
composer update "drupal/core-*" --with-all-dependencies
drush updatedb
drush cache:rebuild