CSRF can happen anytime your server services POSTs† that don't originate from a form served by your server‡.
Not using cookies for authorization doesn't mean CSRF can't happen. An embedded iframe can still POST to any guessable URL with guessable parameters. A custom user-agent can still send guessable headers.
It is one time authentication through lighttpd ldap authentication.
I don't understand the details of this authentication method, but one-time usually solves the problem with CSRF. You won't be vulnerable to CSRF if
- your reboot service always prompts the user to enter their credentials to do a reboot, then it is not by itself idempotent
- the reboot service is only requested from a form with an unguessable action (e.g. one with an embedded secret or embedded credentials) from a page that checks LDAP
- the reboot service only works when it has an unguessable header that is set by a page that checks LDAP then CSRF isn't a problem.
- the reboot service is only reachable by an unguessable URL
† - more generally, any unsafe/side-effecting operation
‡ - more generally, not from code trusted by the origin that services the request