Anonymous session/cookie being generated even for components that don't need it

Problem/Motivation

On a project using just one component (the image hotspot component), we noticed anonymous user sessions were being generated, which essentially disables caching for the site.

This code in getGenericH5PIntegrationSettings is called, regardless of whether components will use those ajax callback urls:

   // Create AJAX URLs
    $set_finished_url = Url::fromUri('internal:/h5p-ajax/set-finished.json', ['query' => ['token' => \H5PCore::createToken('result')]])->toString(TRUE)->getGeneratedUrl();
    $content_user_data_url = Url::fromUri('internal:/h5p-ajax/content-user-data/:contentId/:dataType/:subContentId', ['query' => ['token' => \H5PCore::createToken('contentuserdata')]])->toString(TRUE)->getGeneratedUrl();
    $h5p_url = base_path() . self::getRelativeH5PPath();

and the \H5PCore::createToken('contentuserdata') is what initiates the anonymous user session.

Proposed resolution

Potential fixes include:

• Make anonymous session a configuration option
• If the anonymous session option isn't enabled, only generate those callbacks for authenticated users

Remaining tasks

User interface changes

API changes

Data model changes

Release notes snippet