Moved body parser code above CSRF code in loadExpress method of lib/express module, so that body gets parsed (and _csrf value is made available in request object) before CSRF check is made.

closes #736