Explanation docs: about build_token

[consideRatio]

When we access the binderhub's REST API under /build, there is a build_token that can be relevant to understand more about. This issue represents a summary of insights about it, and can be closed when we understand this well enough and have captured that understanding in the issue. The issue can then be used to write documentation if we conclude its relevant to document this as well.

• Hmm, what I think about build_token is that one is created and associated to the user session the first time you access the /build endpoint. Then subsequent requests all contain it.

• Web request to the /build endpoint is handled by a tornado web request handler, which is considering if its passed a build_token. If it is passed a token, it has to be valid still.
• Web request to the /v2 endpoint is handled by a tornado web request handler, that creates a build_token. This is the only place its being created.
• The build_token was introduced in add build token, apply rate limit by request ip jupyterhub/binderhub#1309