A Drupal website that my company is maintaining has a REST endpoint, using Drupal Services (likely not that relevant). One of the systems that I'm writing has to write changes in the system to that website over REST. To do this, we first have to 'login' to the system, for which we get a session token and id, and then have to get a CSRF token from this same website. To get this token, we have to make a request to the website, giving the token and id we got earlier. After this, we can use the token and id, combined with the CSRF token, to make edit requests.
But why does having to request this CSRF token first make this system any more secure?