Review misc files from PR #75

[willingc]

• add TODO to check security XSRF from review in Clone client #75
• Partially closes Address feedback from PR #75 #86

[todo]

review security #75 (comment)

bookstore/bookstore/clone.html

Lines 29 to 32 in e1f8f5b

	// TODO: review security https://github.com/nteract/bookstore/pull/75#discussion_r280782423
	var xsrf_token = getCookieByName("_xsrf");
	var xhr = new XMLHttpRequest();
	xhr.responseType = "json";

---

This comment was generated by todo based on a TODO comment in e1f8f5b in #89. cc @willingc.

[mpacer]

@captainsafia did I not address your concern by creating a getCookieByName function as you had requested? I'm a little confused as to what needs to be addressed here…

[captainsafia]

Catching up with this conversation.

I was referring to creating a getCookieByName function that did not use regex. The getCookie method used in the notebook code base is copied from the Tornado docs. While it suffices, I think an alternate approach (like splitting on semi-colons and parsing the key values) is easier to read. It's also the approach taken by the js-cookie package that we use rx-jupyter.

[willingc]

Opened #104 and closing this PR in preparation for release.