Yes if the secret is only used once, then that would be a nonce. However it appears to me that many sites do not use a nonce .. the secret does not change with each request. While they do not make use of a nonce, they still defeat CSRF attacks.

Nonce would be an interesting solution but it might increase overheads on high traffic sites while not having enough benefits over a static secret.