* fix: fetch csrf cookie and set headers lazily
* fix: check cookie each call to keep it up to date
Previously the cookie was checked once and never updated until the
client was reloaded. Stale or absent cookies would generate incorrect
tokens or no tokens, respectively, causing CSRF errors.