remove global npm installs
refactor middleware into sep file
factor out the CSRF stuff