The User login and consent flow documentation page states that the login UI should use CSRF tokens (a form of CSRF mitigation) in the login form. However, CSRF only makes sense when a request (such as a POST request) changes the state of the user session (e.g. login CSRF) or has a side-effect that depends on the user session ("normal" CSRF). But the login UI doesn't even have user sessions. Any request which the attacker could do via a cross-site request through the user's browser could also be done by the attacker through his own browser and would have the same effect. So what's the point in mitigating against CSRF in the login UI?