Conditional CSRF for node express