then you need to use a correct csrf token. it doesn't protect against this, anyone can get a valid csrf token, every visitor gets one.