Public apps return 500 on first visit

[cartogram]

Overview

When visiting hydrox.shopifycloud.com for the first time you will see a internal server error page due to the missing session cookie on the initial load.

More information given when loading the app locally incognito:

React server-side rendering error:
Error: Network error: Error writing result to store for query:
 {"kind":"Document","definitions":[{"kind":"OperationDefinition","operation":"query","name":{"kind":"Name","value":"ProjectListQuery"},"variableDefinitions":[],"directives":[],"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"Field","name":{"kind":"Name","value":"projects"},"arguments":[],"directives":[],"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"Field","name":{"kind":"Name","value":"title"},"arguments":[],"directives":[]},{"kind":"Field","name":{"kind":"Name","value":"id"},"arguments":[],"directives":[]},{"kind":"Field","name":{"kind":"Name","value":"__typename"},"arguments":[],"directives":[]}]}}]}}],"loc":{"start":0,"end":53,"source":{"body":"query ProjectListQuery{projects{title id __typename}}","name":"GraphQL request","locationOffset":{"line":1,"column":1}}},"id":"84ca953fd60792db1dfaa69ace54fde92586ed98150b0f2d86f1bd7c67077b11"}
Cannot read property 'projects' of undefined
    at new ApolloError (/Users/mattseccafien/src/github.com/Shopify/hydrox/node_modules/apollo-client/bundle.umd.js:92:26)
    at /Users/mattseccafien/src/github.com/Shopify/hydrox/node_modules/apollo-client/bundle.umd.js:1587:34
    at /Users/mattseccafien/src/github.com/Shopify/hydrox/node_modules/apollo-client/bundle.umd.js:2007:15
    at Set.forEach (<anonymous>)
    at /Users/mattseccafien/src/github.com/Shopify/hydrox/node_modules/apollo-client/bundle.umd.js:2005:26
    at Map.forEach (<anonymous>)
    at QueryManager.broadcastQueries (/Users/mattseccafien/src/github.com/Shopify/hydrox/node_modules/apollo-client/bundle.umd.js:2003:20)
    at /Users/mattseccafien/src/github.com/Shopify/hydrox/node_modules/apollo-client/bundle.umd.js:1482:29
    at process._tickCallback (internal/process/next_tick.js:68:7)

[GoodForOneFare]

Fixed by following quilt_rail's CSRF guide.