This is a bad design. You should be setting the HTTPOnly flag on your cookies because it makes xss more difficult to exploit (but not impossible). If you write the cookie value to the page, then it undermines the protection provided by this flag.
Why are you including the cookie value in a variable with each request? The point of a cookie is that it occupies the
Cookie: http header element of every request... which is redundant. It doesn't matter where the request originates from, the browser keeps track of the cookie. This is one of the reasons why CSRF is a problem.
Read the CSRF prevention cheat sheet and use one of these methods to protect your requests.