learning-unlimited/ESP-Website — comment on commit 07ba05117e36874a4ee01cfb42122b1c68c3a23d
File: esp/public/media/scripts/csrf_check.js line 26
By dehnert:

JavaScript to add the CSRF token to every form isn't directly exploitable, in that it'll never run in the context of an in-progress CSRF exploit --- those all come from off-site, not a form created on our site.

That said, you need to be careful when adding the CSRF token that you don't add it to any forms submitting to untrusted sites, since that leaks the token.