Add config option to opt-out of generating CSRF token

[Lizards]

• This adds a config option ensure_csrf_token to opt-out of django-nextjs automatically generating a CSRF token to include in the request to the NextJS server. It preserves the current behavior by defaulting to True.

  • The comment in _get_nextjs_request_cookies indicates this was done to support a GraphQL use case. But in our project, the behavior is undesirable because of the side-effect of including a Set-Cookie header (see next bullet).

• A new CSRF token value was being generated on every request. This causes Django's CsrfViewMiddleware to include a Set-Cookie header on every response, making all responses from django-nextjs un-cacheable. This updates the behavior to only generate a CSRF token if the settings.CSRF_COOKIE_NAME cookie is not already present in the request.

[Lizards]

Thanks for the feedback, @danialkeimasi. Please take a look again.

[danialkeimasi]

Looks good.