Put simply, CSRF tokens can be sniffed out of responses from the server unless the request/response are transmitted using encryption. Is this enough of a concern to worry about, or is it reasonable to allow the CSRF token to be transmitted via plaintext?
In our case, the framework we're using provides for exactly one CSRF token per session and our application has both HTTP and HTTPS forms to protect. My concern is that an attacker could sniff the CSRF token while the victim is visiting an HTTP page with a form on it and then entice the victim to visit a malicious HTTPS page which posts to a more sensitive HTTPS request handler on our application with the correct CSRF token (put there by the attacker who sniffed it earlier).