[SwanContents] Make download feature set xsrf auth header

This is required after the update to hub v4.1.6

SwanContents/swancontents/serverextension/templates/download.html

@@ -40,16 +40,28 @@
 
 <script type = "text/javascript" >
 
+  function get_headers() {
+      var headers = {
+          'Content-Type': 'application/json'
+      }
+
+      var cookie = document.cookie.match("\\b_xsrf=([^;]*)\\b");
+      var xsrf = cookie ? cookie[1] : undefined;
+      if (xsrf) {
+          headers['X-XSRFToken'] = xsrf // hub auth header
+      }
+
+      return headers
+  };
+
   document.addEventListener("DOMContentLoaded", function() {
     var base_url = document.body.getAttribute("data-baseUrl") || "";
     var urlParams = new URLSearchParams(window.location.search);
     var proj_url = urlParams.get('projurl');
 
     var settings = {
         method: "GET",
-        headers: {
-            'Content-Type': 'application/json'
-        }
+        headers: get_headers()
     };
 
     fetch(base_url + 'api/contents/fetch?url=' + encodeURIComponent(proj_url), settings)