js: Extract csrf.js and include in common bundle.

This should make it possible to use this AJAX setup code in logged-out
code as well, which is necessary to use blueslip from portico pages.

.eslintrc.json

@@ -52,6 +52,7 @@
         "condense": false,
         "confirm_dialog": false,
         "copy_and_paste": false,
+        "csrf": false,
         "csrf_token": false,
         "current_msg_list": true,
         "drafts": false,

static/js/csrf.js

@@ -0,0 +1,15 @@
+var csrf_token;
+$(function () {
+    // This requires that we used Jinja2's {% csrf_input %} somewhere on the page.
+    csrf_token = $('input[name="csrfmiddlewaretoken"]').attr('value');
+    window.csrf_token = csrf_token;
+
+    $.ajaxSetup({
+        beforeSend: function (xhr, settings) {
+            if (!(/^http:.*/.test(settings.url) || /^https:.*/.test(settings.url))) {
+                // Only send the token to relative URLs i.e. locally.
+                xhr.setRequestHeader("X-CSRFToken", csrf_token);
+            }
+        },
+    });
+});

static/js/setup.js

@@ -1,7 +1,8 @@
 // Miscellaneous early setup.
 
-var csrf_token;
 $(function () {
+    csrf.initialize();
+
     if (util.is_mobile()) {
         // if the client is mobile, disable websockets for message sending
         // (it doesn't work on iOS for some reason).
@@ -19,10 +20,6 @@ $(function () {
     } else if (!page_params.needs_tutorial) {
         $('#first_run_message').show();
     }
-    // This requires that we used Django's {% csrf_token %} somewhere on the page.
-    csrf_token = $('input[name="csrfmiddlewaretoken"]').attr('value');
-    window.csrf_token = csrf_token;
-
 
     // This is an issue fix where in jQuery v3 the result of outerHeight on a node
     // that doesn’t exist is now “undefined” rather than “null”, which means it
@@ -37,15 +34,6 @@ $(function () {
         return $(this).outerWidth.apply(this, arguments) || 0;
     };
 
-    $.ajaxSetup({
-        beforeSend: function (xhr, settings) {
-            if (!(/^http:.*/.test(settings.url) || /^https:.*/.test(settings.url))) {
-                // Only send the token to relative URLs i.e. locally.
-                xhr.setRequestHeader("X-CSRFToken", csrf_token);
-            }
-        },
-    });
-
     // For some reason, jQuery wants this to be attached to an element.
     $(document).ajaxError(function (event, xhr) {
         if (xhr.status === 401) {

tools/webpack.assets.json

@@ -37,6 +37,7 @@
         "string.prototype.codepointat",
         "./node_modules/jquery/dist/jquery.js",
         "./node_modules/underscore/underscore.js",
+        "./static/js/csrf.js",
         "./static/js/blueslip.js",
         "./static/third/bootstrap/js/bootstrap.js",
         "./static/js/common.js",