CSRF Protection in PHP
This seems quite reasonable as a baseline for CSRF protection. Critically, you must ensure that you do not set the Access-Control-Allow-Origin (CORS) header to a wildcard, otherwise an attacker can just perform an Ajax request to your site and gain access to the CSRF token.

A criticism of single global CSRF tokens is that that exposing the CSRF token allows re-use across different requests, which can be avoided. The upside of the single global token model is that it is very simple to implement and therefore has less chance of bugs. Additionally, it is unlikely that an attacker will gain read-access to only one page and not others, particularly as XSS would allow Ajax requests to other pages on the same origin (same domain).

If you wish to generate tokens that are locked to their initial purpose (i.e. a particular form target URI), a fairly sensible approach is to use HMAC-SHA256 to generate each token. Generate a global CSRF key as part of your session data, then for each token you need to generate compute a HMAC-SHA256 digest of the target URI using the CSRF key as the HMAC key, then inject that digest as the CSRF token in the form. For validation, take the request URI and hash it using the CSRF key, then compare that to the CSRF token provided as part of the request.

If you're building any kind of framework to handle MVC or MVVM then I would implement the CSRF protection as a by-default for all requests in the parent view or controller class, then have a way to opt-out of CSRF validation explicitly. CodeIgniter 3.x handles this quite nicely, so you should check out their code as an example.

One thing I would probably add is logging of cases where CSRF validation fails, although the way you do that is very much down to your platform.