CSRF protection works differently. Let's say, I craft a URL that adds
an admin user for me on site mysite:
https://mysite/create_admin_url/
Then I sent it to the admin of mysite with reasonable text:
"Please look at my comment ...". He clicks on the url and
voila -> Admin created!
CSRF prevents an attacker from doing that, he could maybe create a
malicious URL or form and trick an admin to click on it. But for some
attacker somewhere it is impossible to find out what the CSRF token of
the current session of the admin user is.
The token doesn't protect against e.g. injected javascript. It only
protects against "tricks from the outside".
