Kubeflow Authentication breaks with JupyterLab 4

[TobiasGoerke]

With JupyterLab 4.x the /tree path returns a 404 for some reason.
This breaks iff authenticating with a Kubeflow instance in getXSRFToken (link), as the result is expected to be a http 200.

This only applies to Kubeflow instances, for which the sessionCookie param is used see line 205.

I've tried using tokenUrl = new URL('lab', addTrailingSlash(url)).toString(); instead, which works great for JupyterLab 4 Notebooks hosted on Kubeflow.

I'll happily create a PR if this is an appropriate fix. Thanks!