[api] enable CSRF by default (#9205)

* [api] Fix, don't exempt CSRF on APIs

* adds cookie based CSRF token support

* blacking

Co-authored-by: ʈᵃᵢ <tdupreetan@gmail.com>

superset-frontend/src/setup/setupClient.js

@@ -18,15 +18,19 @@
  */
 /* eslint no-console: 0 */
 import { SupersetClient } from '@superset-ui/connection';
+import parseCookie from 'src/utils/parseCookie';
 
 export default function setupClient() {
   const csrfNode = document.querySelector('#csrf_token');
   const csrfToken = csrfNode ? csrfNode.value : null;
 
+  // when using flask-jwt-extended csrf is set in cookies
+  const cookieCSRFToken = parseCookie().csrf_access_token || '';
+
   SupersetClient.configure({
     protocol: (window.location && window.location.protocol) || '',
     host: (window.location && window.location.host) || '',
-    csrfToken,
+    csrfToken: csrfToken || cookieCSRFToken,
   })
     .init()
     .catch(error => {