Update GetWebSessionRequest to support masquerading

[rh12]

refs: MBL-17910
affects: Student, Teacher, Parent
release note: none

Problem

When an admin acted as a student, closed discussions were still repliable, although students should not be able to reply to closed discussions. This was because the hybrid discussion page was reached with the admin's permissions instead of the masqueraded user's.

Solution

When masquerading getting session_token needs to use "/api/v1/login/session_token" path instead of "/login/session_token", and the URL in the return_to query parameter also needs to have the as_user_id parameter.

Test plan:

• Verify closed discussions are not repliable when an admin acts as a student. See ticket for details and credentials.
• Verify it works properly when logging in as the student, directly.
• Smoke test a K5 user's Homeroom, Classes, etc.

Screenshots

Before	After

Checklist

• Follow-up e2e test ticket created
• Tested on phone
• Tested on tablet

[inst-danger]

Teacher Build QR Code:

[inst-danger]

Parent Build QR Code:

[inst-danger]

Student Build QR Code:

[inst-danger]

	Warnings
⚠️	This pull request will not generate a release note.

Affected Apps: Student, Teacher, Parent

MBL-17910

Coverage	New %	Master %	Delta
Canvas iOS	91.7%	91.69%	0%

Generated by 🚫 dangerJS against 0bad7cc