set xsrf cookie on base url

[minrk]

avoids collisions across a given host

closes jupyterhub/jupyterhub#3624

[codecov-commenter]

Codecov Report

Merging #612 (9619019) into master (6c8c923) will increase coverage by 0.03%.
The diff coverage is 50.00%.

@@            Coverage Diff             @@
##           master     #612      +/-   ##
==========================================
+ Coverage   77.36%   77.39%   +0.03%     
==========================================
  Files         110      110              
  Lines       10252    10254       +2     
  Branches     1259     1260       +1     
==========================================
+ Hits         7931     7936       +5     
+ Misses       1926     1919       -7     
- Partials      395      399       +4     

Impacted Files	Coverage Δ
jupyter_server/serverapp.py	65.44% <50.00%> (-0.03%)	⬇️
jupyter_server/tests/services/kernels/test_api.py	97.02% <0.00%> (-1.99%)	⬇️
jupyter_server/services/kernels/kernelmanager.py	81.84% <0.00%> (+2.05%)	⬆️

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 6c8c923...9619019. Read the comment docs.