Does CSRF protection for controller actions require POST?
According to https://craftcms.com/support/csrf-protection CSRF does require POST requests


  With CSRF protection enabled, all of your site’s visitors will get a “CRAFT_CSRF_TOKEN” cookie set on their browser, and all POST requests must be accompanied by a POST parameter with a matching name and value (the CSRF Token).


On top of that, you'll need to (manually) enable it in your config:


  You will need to enable it to take advantage of it. You can do that by setting the enableCsrfProtection config setting in your craft/config/general.php file.