If request header contains `X-HTTP-Auth-Override` we won't send back the header `WWW-Authenticate` OR
since event source (sse) can't use custom headers this will also check if the request is for the SSE endpoint
This is replica of CookieCsrfTokenRepository to support sameSite attribute
for cookie
A CsrfTokenRepository that persists the CSRF token in a cookie named
"XSRF-TOKEN" and reads from the header "X-XSRF-TOKEN" following the conventions of
AngularJS.