Add test for asset request subscriber predicate

Currently failing!
Fix asset request subscriber predicate

Rather than just returning whether the request is an asset request,
compare this fact against the predicate parameter value. With this
it's possible to set subscribers that only fire when a request is
NOT an asset request.
Don't set XSRF-TOKEN cookie on asset requests

This may finally fix the intermittent test failures. In particular,
since static assets are often requested in parallel this prevents
race conditions with requests which modify the session.