CSRF-defense using Tokens

Question

I'm designing a CSRF defense in a Grails 2.4.5 application.

I would like to use the Synchronizer Tokens pattern, and here is the design I intend, simplified:

1. With a new session, on the server, generate a long unique csrf token.
2. Store the csrf token in the session.
3. Add the csrf token to the response header
4. On the server, for every incoming request that will potentially change application state (post, update, delete...) validate that the referer/origin is the same as the target
5. On the server, for every incoming request that will potentially change application state (post, update, delete...) check the presence and validity of the csrf token in the header.
   In a grails app, I imagine this taking place in the Spring Security filterchain.
6. If the token is not present or does not match, return an error and log a potential CSRF attack, otherwise allow the request to proceed.

Does this sound correct?

My concern is that it's not sufficient. Officially, the synchronizer token is added to every form and every post, put, or delete URL. Yet, the application doesn't use form tags, so it seems to be onerous to add it to every single JavaScript-generated form in the application, not to mention requiring extensive testing to make sure no existing functionality is broken.

Thanks!