[wab] Exempt hydration script routes from CSRF to make them CDN-cacheable (#3142)