Who said anything about course locking? Most databases support row level locking (think lock user row so each user cannot submit multiple orders at the same time).

And I think you are misunderstanding CSRF. As the name implies it is protection against Cross Site attacks and will do nothing to help you prevent race conditions.