Plugin changes authentication in http requests to local files

I've run into this via https://github.com/bokeh/jupyterlab_bokeh/issues/42 and https://github.com/altair-viz/altair/issues/927.

When ipympl is installed, http requests to local files (GET /files/...) made by the vega plugin stop working. They get forwarded to /login with a 302 status code. Installing ipympl seems to cause the requests to be sent without any cookies. In my case requests *without* ipympl present had cookie data `_xsrf, csrftoken, username-localhost-8888, username-localhost-8889`.

Start with the linked jupyterlab_bokeh and Altair issues, then reproduce the local `/files/...` request with ipympl installed and absent. Trace why the request loses cookies and receives a 302 redirect to `/login`; done means local-file requests retain the expected cookies and no longer redirect unexpectedly.

Written by the indexing model from the issue text.