tried to inject Authorization header for each request, but couldn't.

custom.js

// This way didn't work.
// Cause this custom.js or nbextensions files will be loaded after initializing JupyterNotebookApp.
// It means this code won't affect to it's initializing Ajax requests.

// Sending token on each XHRs too.
// Because Safari won't handle Cookie and localStorage
// on iframes.
// Jupyter Client expects it's cookie, so it will be forbidden
// Instead, sending "token" by manually on each XHRs.

//   Retrieving token from data attribute
//   Because Jupyter Notebook will delete ?token param automatically.
var token = document.querySelector('body').dataset.jupyterApiToken || '';
jQuery.ajaxSetup({
  headers: {"Authorization": 'token ' + token}
});