Really interesting but not pinterest getting hacked. This is simply an admin interface to spam pinterest.

CSRF token and sessionid is probably needed to create an account directly because by default django has CSRF protection built in and maybe in order to hit the create account page you need to manually grab it.