Add Scratch Addons identification to /csrf_token route - #7646

The requests sent by the background page of the extension to scratch.mit.edu endpoints (/session, /csrf_token, etc) can be identified with some degree of confidence by checking the value of the Sec-Fetch-Site header. It is set to none (instead of same-origin) by the browser, even though host permissions were granted by the user.

It is unlikely there is other software used by hundreds that requests /csrf_token so I think we should assume it is Scratch Addons.

Related: #6729

To clarify, due to #6614 we can affirm that Scratch Addons is sending no more than 1 request for each 1.5 seconds / user. But apparently, when all users are online, it can really add up.

Superseded by #7647.

These requests are no longer sent, so there's nothing we can add these URL params to.
Also, checking the coexistence of the Cookie header and Sec-Fetch-Site:none should be enough to identify that a browser extension is sending the requests from its background process. Further work to identify and throttle requests sent by the extension in all contexts, including the popup and Scratch tabs, can be discussed in issue #6729.