We already use a token for preventing CSRF when marking notifications read.
Making a user confirm the marking read action serves no real purpose. No
information will be lost by just marking the notifications read but it will
prevent users from always having to confirm this action.
PHPBB3-13189