FIX: Always use the current session token in uppy (#23812)

…rather than the value at the time when uppy is initialized.

Future TODO: extract csrf-fetching logic from ajax helper to Session service.

app/assets/javascripts/discourse/app/mixins/composer-upload-uppy.js

@@ -544,9 +544,9 @@ export default Mixin.create(ExtendableUploader, UppyS3Multipart, {
   _useXHRUploads() {
     this._uppyInstance.use(XHRUpload, {
       endpoint: getURL(`/uploads.json?client_id=${this.messageBus.clientId}`),
-      headers: {
+      headers: () => ({
         "X-CSRF-Token": this.session.csrfToken,
-      },
+      }),
     });
   },
 

app/assets/javascripts/discourse/app/mixins/uppy-upload.js

@@ -350,9 +350,9 @@ export default Mixin.create(UppyS3Multipart, ExtendableUploader, {
   _useXHRUploads() {
     this._uppyInstance.use(XHRUpload, {
       endpoint: this._xhrUploadUrl(),
-      headers: {
+      headers: () => ({
         "X-CSRF-Token": this.session.csrfToken,
-      },
+      }),
     });
   },