After reading this question, if my understanding is correct, the server sends the CSRF token downstream as a cookie. On first glance, that would seem to defeat the purpose of the token since all cookies are sent by the browser even if the request isn't of the same origin.
However, in order to write it as a custom field, you need to read it first, which you can do only if you are same-origin. So the request proves it comes from code that has "the right to read" from the cookie jar - which is different from the browser sending it on your behalf.
But I am not sure if I understood it correctly. Is that how it works?