[FEATURE] Include csrf header in api requests

[alexjball]

#158 adds csrf protection in production. This involves checking that requests include the X-CSRF-TOKEN header using the value of the csrf_access_token cookie. So we need to update the frontend (frontend/helpers/api) to copy the cookie into the header.

https://flask-jwt-extended.readthedocs.io/en/stable/token_locations/#cookies