CSRF only on POST request, reason?

Incidentally, is there a way to subscribe to a thread without having to reply to it?

Look in the upper right of the first post in the thread (also shows as first post of a page, if there are multiple pages). There is some text called "Thread Modes", click that and a dropdown will appear with a subscribe link. It's not very obvious because it's just text and not a button or something that stands out.