Usually a CSRF token is bound to a session. So in addition to the CSRF token I would expect you also need to sustain the session, which is typically done by sustaining a session cookie in the HTTP header.