From the express docs, use `X-CSRF-Token`: http://expressjs.com/api.html#csrf