Generating URL with CSRF token
Well, I found a solution, however, I'd be amazed if there isn't a better way to do it, and in fact I'm pretty sure it's bypassing the placeholder API, so it's likely the wrong way to do it. But until someone gives me a better solution, it's a working one.

The solution is to generate the token manually, then set it as a GET query on the URL when generating the URL. 

When generating the token however, you need the internal path for the route, which is used as a basis for generating the token.

$url = Url::fromRoute('mp.ajax.authorized');
$token = \Drupal::csrfToken()-&gt;get($url-&gt;getInternalPath());
$url-&gt;setOptions(['absolute' =&gt; TRUE, 'query' =&gt; ['token' =&gt; $token]]);
$absolute_url = $url-&gt;toString()


Note that I've already found this method doesn't work on routes with optional parameters, so if someone comes across this, you'll have to find another method in such a case.