A browser attaches your cookies to a request because of where the request is going, not because of where it came from. That is the whole mechanism, it is why sessions work at all, and it is why a form on somebody else's page can send an authenticated request as you.
So the cookie answers one question — who is this? — and a state-changing request needs the answer to a second one: did they mean to send this? A token the page had to have been served in order to know is what answers it.
POST /profileA request with a session cookie and nothing else. One of these builds asks for more.