Merge pull request from GHSA-64x5-55rw-9974

lost in forward-port PR 478

Co-authored-by: Zachary Sailer <zsailer@apple.com>

jupyter_server/base/handlers.py

@@ -855,6 +855,7 @@ def head(self, path):
     @authorized
     def get(self, path, **kwargs):
         """Get a file by path."""
+        self.check_xsrf_cookie()
         if os.path.splitext(path)[1] == ".ipynb" or self.get_argument("download", None):
             name = path.rsplit("/", 1)[-1]
             self.set_attachment_header(name)