    def check_xsrf_cookie(self, handler):
        """check_xsrf_cookie patch

        Applies JupyterHub check_xsrf_cookie if not token authenticated
        """
        if getattr(handler, '_token_authenticated', False) or handler.settings.get(
            "disable_check_xsrf", False
        ):
            return
        check_xsrf_cookie(handler)
check_xsrf_cookie patch

Applies JupyterHub check_xsrf_cookie if not token authenticated
jupyterhub/services/auth.py