Go to
app\Http\Middleware\VerifyCsrfToken.php and add the URIs to cancel, e.g.

protected $except = [
    '/payment/callback',
];

This is very necessary when other sites want to POST to our URL.