Well I'd say yes you have to do it, look at this excerpt taken from owasp ( Open Web Application Security Project ) documentation:


  When targeting a normal user, a successful CSRF attack can compromise
  end-user data and their associated functions. If the targeted end user
  is an administrator account, a CSRF attack can compromise the entire
  Web application. The sites that are more likely to be attacked are
  community Websites (social networking, email) or sites that have high
  dollar value accounts associated with them (banks, stock brokerages,
  bill pay services). This attack can happen even if the user is logged
  into a Web site using strong encryption (HTTPS). Utilizing social
  engineering, an attacker will embed malicious HTML or JavaScript code
  into an email or Website to request a specific 'task url'. The task
  then executes with or without the user's knowledge, either directly or
  by utilizing a Cross-site Scripting flaw (ex: Samy MySpace Worm).


Do I need csrf tokens after login?
More specifically above r=6 and below r=4+4cos(θ)

graph of the two curves

PolarPlot[{6, 4 + 4 Cos[t]}, {t, 0, 2 Pi}]

