This should also cover for the case when it is the same user and CSRF protection is not enabled, checking for CSRF protection and validating the token if it is enabled should be done inside this if block.

You should also handle the case when CSRF token is not valid.