include xsrf token in event stream request

[minrk]

JupyterHub 4.1 increases strictness of xsrf checks (omitting it is no longer allowed on GET requests that are Sec-Fetch: cors, which includes this EventStream).

closes #344

[yuvipanda]

Thanks @minrk

I suspect the tests are failing because we need to now also specify the XSRF token in

nbgitpuller/tests/test_api.py

Line 16 in 518c9c8

query_args = {"token": "secret"}

. But given that's coming from a python client, I'd have thought that it shouldn't have issues as long as the token is present?

[minrk]

Correct, if a token is present, xsrf shouldn't be checked. I'll have a look

[minrk]

403 was because I had an unrelated change in here to turn 302 into 403 while I was testing (302 to login on the EventSource isn't going to work). I've pulled that out and will do a separate PR.

[minrk]

Failure was unrelated, pulled out to #347