Csrf

depends on #23 (or we could switch to express.cookieSession(), but I prefer client-sessions)

fixes #26