I'm in 2 minds about this.

On the one hand, it makes sense to do CSRF checks only when authenticated by a cookie, on the other hand, I'd rather keep it a conscious decision by the developer working on middleware to skip the CSRF check.