Fix CSRF propery deprecated warning

Express middleware is throwing `req.session._csrf is deprecated, use req.csrfToken() instead`. This fixes the warning in `core/server.js`. Another warning is produced by `node_modules/express/node_modules/connect/lib/middleware/cookieSession.js:101`.