new csrf-lite version in package.json

The initial version of csrf-lite was getting installed, and npm-www would throw an error due to the the `valid` alias not yet existing.