How do the xsrf tokens get inserted into urls?

[jasongrout]

The url resolver (https://github.com/jupyterlab/jupyterlab/blob/fa54a84033c1010ea5eed170b682c98c64f6f63e/packages/rendermime/src/registry.ts#L357) asks the contents service to transform the url, adding the xsrf token: https://github.com/jupyterlab/jupyterlab/blob/fa54a84033c1010ea5eed170b682c98c64f6f63e/packages/services/src/contents/index.ts#L1088