given that the POINT of a CSRF token is to prove to the server that a request is coming from a browser instance that is executing your JavaScript code, and not just a hyperlink someone clicked in an e-mail, I'm inclined to assume the answer is "no, it's not included automatically"