xblock-external-ui: Add a unit test for CorsCSRFMiddleware
xblock-external-ui: Fail early if the XBlock view is called anonymously

We used to serve anonymous requests, but most XBlocks assume that the
user is logged in, which can generate a lot of errors when the user is
accessed or when an XBlock ajax callback is queried. Fail early to only
get one error per page load, and prevent displaying the XBlock
altogether when the LMS doesn't find an active user session.
xblock-external-ui: Add request params in view render context