Why is document.cookie returning null when the CSRF token is clearly visible in DevTools

This is because it's http only presumably. That's a key part of the security of CSRF tokens!