csrf: make req.session._csrf non-enumerable