Updated package.json with new csrf-lite version

`npm install` was overwriting the checked in version of csrf-lite
Link to user's starred packages on profile

Previously you would only see a link to a user's starred packages
if the user had > 20 starred. We should link to this regardless
to point out that the page is there (I didn't even know about it
until I starred > 20 packages.