Any specific reason for this?

Avoids leaking a private information by email? CSRF token have a life-span that could imply that the admin are receiving by email a token that's still valid for a few minutes.

Right, but the csrf token is tied to the session token, which we are not sending, and if the admin can lookup a valid session, he can just as easily grab the csrf token while he's at it

Doesn't mean we should provide the info in the email (imho)

Sure. The PR itself is fine and feel free to merge it.
Just saying I don't see a hard reason though.