Try adding _csrf_token: "TRUE" in the routing requirements, like so,
requirements:
_csrf_token: 'TRUE'
You will also be required to auto generate the token from Drupal and use it in the request uri like so /ls/topdf?token=some auto generated token
Here is an example of how to auto generate a token from Drupal (I'm not sure if your Javascript runs on Java or on The Drupal app, but assuming it's from the Drupal app, you can pass the token from Drupal to your js);
$url = \Drupal\Core\Url::fromRoute('mymodule.to_pdf');
$token_service = Drupal::get('csrf_token')
$the_token = $token_service->get($url->getInternalPath());
Thus:
form.setAttribute('action', `/ls/topdf?token=${the_token from drupalSettings}`) ;