This is a bad design. You should be setting the HTTPOnly flag on your cookies because it makes xss more difficult to exploit (but not impossible). If you write the cookie value to the page, then it undermines the protection provided by this flag.
Why are you including the cookie value in a variable with each request? The point of a cookie is that it occupies the
Read the CSRF prevention cheat sheet and use one of these methods to protect your requests.