include access token in client requests, if defined

this allows h5web to work in CORS jupyterlab deployments
and JupyterHub 4.1 which has stricter XSRF rules

src/H5webApp.tsx

@@ -25,11 +25,18 @@ function TwoRenderApp() {
 
 function H5webApp(props: { filePath: string }) {
   const { filePath } = props;
-  const { baseUrl } = ServerConnection.makeSettings();
+  const { baseUrl, token } = ServerConnection.makeSettings();
+  const headers = {};
+  if (token) {
+    headers.Authorization = `token ${token}`;
+  }
 
   const axiosConfig = useMemo(
-    () => ({ params: { file: filePath } }),
-    [filePath]
+    () => ({
+      params: { file: filePath },
+      headers: headers,
+    }),
+    [filePath, token]
   );
 
   return (