Extract Client::token() with the get-or-fetch logic for CSRF tokens

This will be used later on by the uploading code that can't use post_with_token().