Updated package.json with new csrf-lite version

`npm install` was overwriting the checked in version of csrf-lite