CSRF token and initial webapp data retrieval through hello endpoint

To make sure there is a CSRF token available, the webapp always calls an endpoint that's configured to always provide a CSRF token. This endpoint is also used to pass configuration information to the frontend (i.e. dynamic, per-deployment data) and information about the currently authenticated user, if applicable.