Don't emit an antiforgery token on every page for signed-in users #1607

_Layout.cshtml calls Antiforgery.GetAndStoreTokens on every page for signed-in users, adding Set-Cookie and no-store/Pragma headers everywhere, and would leak a shared token if [OutputCache] is ever applied. Fetch the token lazily only where a script needs it. The layout and ReadingContext view component also each re-check SignInManager.IsSignedIn.

Found during review of #1267; intentionally kept out of that PR.