One nice thing about this approach is that it also protects GET requests, which in many cases are impossible to protect with CSRF tokens. CSRF protection for GET requests is considered less crucial, because correctly designed GETs can not change state of resources, so can not perform any sensitive action. But GETs can leak sensitive information, like for example the fact that the user is logged into certain services. With same-site attribute this problem should be solved.