The first dialog was being given the wrong user ($user, should be $viewer), leading to a CSRF issue.
(The CSRF token it generated was invalid in all validation contexts, so this wasn't a security problem or a way to capture CSRF tokens for other users.)
Use newDialog() instead.
(This seems completely unrelated to the vaguely-similar-looking issues we saw earlier this week.)