The coins stolen from Mt.Gox were not stolen using any CSRF exploit.
So they were stolen from Mt.Gox using another exploit...?
No, they logged in on users account using the correct login and password. We have logs showing the loggin succeed on first try.