Who said anything about course locking? Most databases support row level locking (think lock user row so each user cannot submit multiple orders at the same tim

Who said anything about course locking? Most databases support row level locking (think lock user row so each user cannot submit multiple orders at the same time). And I think you are misunderstanding CSRF. As the name implies it is protection against Cross Site attacks and will do nothing to help you prevent race conditions.