I'd actually prefer just using express.csrf() directly in the functions