I thought this was to combat cross-site request forgery attacks?

Else couldn't one set up malicious scripts to up-or downvote many stories, or post comments under someone else's name?