In their guidelines for securing your application against CSRF attacks, OWASP recommends two separate checks:
1. Check standard headers to verify the request is same origin 2. AND Check CSRF token
This question asks if it suffices to check the headers without having a token. I am wondering the converse - is it sufficient to create and check an encrypted CSRF token without checking any headers?