Revert "Remove "assertion" GET param from token requests"

This reverts commit e0e23bde. This needs
more thought, as the X-CSRF-Token header won't currently be set for
cross-domain requests (such as those made by the extension sidebar).

h/static/scripts/auth.js

@@ -24,9 +24,12 @@ var cachedToken = INITIAL_TOKEN;
  * @return {Promise} - A promise for a new JWT token.
  */
 // @ngInject
-function fetchToken($http, settings) {
+function fetchToken($http, session, settings) {
   var tokenUrl = new URL('token', settings.apiUrl).href;
   var config = {
+    params: {
+      assertion: session.state.csrf,
+    },
     // Skip JWT authorization for the token request itself.
     skipAuthorization: true,
     transformRequest: function (data) {
@@ -47,7 +50,7 @@ function fetchToken($http, settings) {
 // @ngInject
 function fetchOrReuseToken($http, jwtHelper, session, settings) {
   function refreshToken() {
-    return fetchToken($http, settings).then(function (token) {
+    return fetchToken($http, session, settings).then(function (token) {
       return token;
     });
   }

h/static/scripts/test/auth-test.js

@@ -16,6 +16,7 @@ describe('auth', function () {
       get: sinon.spy(function (url, config) {
         assert.equal(config.skipAuthorization, true);
         assert.equal(url, 'https://test.hypothes.is/api/token');
+        assert.equal(config.params.assertion, fakeSession.state.csrf);
 
         var result = {status: 200, data: fakeTokens[fakeTokenIndex]};
         ++fakeTokenIndex;