> does auth contains a CSRF token?

Yes, it looks like it does. Also, the vote auth param is different for every link.