Fix css on production You don't have access to this project (#1194)

## Description

The issue it's the production bug only. In all other cases, session was
used (same domain on canvas and on builder).

closes #1159

## Steps for reproduction

1. click button
2. expect xyz

## Code Review

- [ ] hi @kof, I need you to do
  - conceptual review (architecture, feature-correctness)
  - detailed review (read every line)
  - test it on preview

## Before requesting a review

- [ ] made a self-review
- [ ] added inline comments where things may be not obvious (the "why",
not "what")

## Before merging

- [ ] tested locally and on preview environment (preview dev login:
5de6)
- [ ] updated [test
cases](https://github.com/webstudio-is/webstudio-builder/blob/main/apps/builder/docs/test-cases.md)
document
- [ ] added tests
- [ ] if any new env variables are added, added them to `.env.example`
and the `builder/env-check.js` if mandatory

apps/builder/app/shared/context.server.ts

@@ -15,7 +15,16 @@ const createAuthorizationContext = async (
   request: Request,
   buildEnv: AppContext["authorization"]["buildEnv"]
 ): Promise<AppContext["authorization"]> => {
-  const url = new URL(request.url);
+  const originUrl = new URL(request.url);
+  let url = originUrl;
+
+  // In case of css use referrer as url to extract tokens from canvas iframe href
+  if (originUrl.pathname === "/s/css") {
+    const referer = request.headers.get("referer");
+    if (referer !== null) {
+      url = new URL(referer);
+    }
+  }
 
   const authReadTokenRaw = url.searchParams.get("authReadToken") ?? undefined;
   const authToken = url.searchParams.get("authToken") ?? url.hostname;