Removed code in lib/express module that was preventing the CSRF hook from doing its job.
Added utility function for determining whether a request originated from the same domain as the server (more or less).
Updated CSRF hook to not check the token on cross-origin requests.
Updated CORS hook to not blank out token on same-origin requests.

refs #911