Here’s my go to article on this behaviour:

http://blog.opensecurityresearch.com/2012/02/json-csrf-with-...