XenForo uses ajax to refresh your csrf token after you're inactive for a long period of time. If you keep your tab open for at least 50 minutes without focusing on it, next time you make it the active tab, it'll use ajax to refresh the token which also checks for unread messages and new alerts.
If you really are curious you can look at this area in xenforo.js:
XenForo.CsrfRefresh