xblock-external-ui: Add XBlock API call to render XBlock views
xblock-external-ui: Include CSRF token in the API answer
xblock-external-ui: Adds support for CORS headers (cross-domain request)
xblock-external-ui: Include full path when building local_url
xblock-external-ui: Fix TestHandleXBlockCallback & bok_choy, add tests

* Fix tests of TestHandleXBlockCallback
* Fix bok_choy tests
* Add test for xblock_view
xblock-external-ui: Only return `instance` in `_invoke_xblock_handler()`
xblock-external-ui: Group resources by hash tag to avoid duplicate loads
xblock-external-ui: Alternate referer check for CORS requests
xblock-external-ui: Allow to disable httponly on session cookies
xblock-external-ui: Remove scaffolding & PEP8
xblock-external-ui: Add a unit test for CorsCSRFMiddleware
xblock-external-ui: Fail early if the XBlock view is called anonymously

We used to serve anonymous requests, but most XBlocks assume that the
user is logged in, which can generate a lot of errors when the user is
accessed or when an XBlock ajax callback is queried. Fail early to only
get one error per page load, and prevent displaying the XBlock
altogether when the LMS doesn't find an active user session.
xblock-external-ui: Add request params in view render context