As @aczire I dont think this module is exploiting CSRF, since it's interacting with the server directly, without any user/browser interaction. So I would ask to delete the CSRF from the title here. (Even when probably the app could be vulnerable to CSRF, this module isn't abusing it).