I guess my true questions is why do you need csrf token and SOP (strict CORS policy isn't enough).
CSRF: when evil.com makes request to bank.com/logout
If evil.com does it through XHR, then browser will simply give Cross origin error as server has strict CORS policy.
If person does curl request than there is no point since they don't have the cookie session data to perform action with.
...now this is my understanding that requests made by tags like form, img, script, and some meta tags aren't blocked by browser even if request is to different origin.
So is cookie data sent with these requests, and server can still see referrer/Origin headers. If so...
then in won't that be enough to prevent any CSRF attack as server knows wether request was made from right site or not.