Grav in subfolder without site visitors ever knowing

I may have celebrated too early. The frontend does work, but trying to log into the admin backend (I have the admin plugin installed) gives me an Invalid Security Token error. It’s almost like the admin plugin needs to be modified to use the custom_base_url_absolute as well, but I wouldn’t know where to do that or if that is really the problem. Any ideas or do any of you encounter this too? My htaccess file looks like this now:

RewriteRule ^admin(.)/?$ /grav/admin/$1 [NC,L]
RewriteRule ^user/(.
)/?$ /grav/user/$1 [NC,L] #to ensure css loads correctly in admin
RewriteRule ^system/(.)/?$ /grav/system/$1 [NC,L] #to ensure jquery loads correctly in admin
RewriteRule ^mycmshome(.
)/?$ /grav/mycmshome/$1 [NC,L]

So just to recap: if I comment out custom_base_url_absolute, the admin backend works fine at /grav/admin, but the frontend gives me a Grav 404 if I go to /mycmshome. Having custom_base_url_absolute set, the frontend works fine, but the admin backend gives me the Invalid Security Token error.

Thanks again for your help!