Remove no-longer needed inclusion of xsrf token

[krassowski]

This is no longer needed because the token is now included; in fact the inclusion now prevents the second instance from accepting the request.

Reference Issues or PRs

Follow-up to #44

What does this implement/fix?

Put a x in the boxes that apply

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds a feature)
• Breaking change (fix or feature that would cause existing features not to work as expected)
• Documentation Update
• Code style update (formatting, renaming)
• Refactoring (no functional changes, no API changes)
• Build related changes
• Other (please describe):

Testing

• Did you test the pull request locally?
• Did you add new tests?

[github-actions]

👈 Launch a Binder on branch nebari-dev/jupyterlab-gallery/remove-no-longer-needed-xsrf

[krassowski]

This does not work - the GET succeeds but POST fails; it appears auth token is only checked later? Or only for GET/HEAD/OPTIONS.