don't CSRF-protect the instfs backchannel
don't CSRF-protect the instfs backchannel

it's protected by JWT authentication instead

test-plan:
 - when running in an environment with CSRF protection enabled (i.e. not
   development, e.g. test)
 - with instfs plugin enabled and service running and configured
 - try to upload a file
 - upload should complete without error
 - in same setup (CSRF protected), try and initiate a file upload
   outside of the canvas UI, e.g. with curl
 - should still be blocked by CSRF protection

Change-Id: If26d262b4cfb87ddfeb6fffca3493b7d56da7586
Reviewed-on: https://gerrit.instructure.com/130026
Reviewed-by: Andrew Huff <b334cc62d1472ff334a155064665c29200a80f59@instructure.com>
QA-Review: Collin Parrish <aa381382ccdcc876f5cf7879d921ed03200f6804@instructure.com>
Tested-by: Jenkins
Product-Review: Jacob Fugal <f862f167b85d41b225785c70d70808bc7337c1fe@instructure.com>

djbender/canvas-lms,sfu/canvas-lms,instructure/canvas-lms,sfu/canvas-lms,instructure/canvas-lms,instructure/canvas-lms,instructure/canvas-lms,instructure/canvas-lms,sfu/canvas-lms,djbender/canvas-lms,sfu/canvas-lms,instructure/canvas-lms,sfu/canvas-lms,djbender/canvas-lms,sfu/canvas-lms,instructure/canvas-lms,sfu/canvas-lms,djbender/canvas-lms