CSRF middleware: expose defaultValue() function

This makes it convenient to write and provide a custom value() function that can still fall back to the default one.

E.g. during development purposes, I want to ignore CSRF for certain API endpoints. With this, I could achieve that by providing a custom function like:

```js
connect.csrf({
  value: function (req) {
    if (req.path.indexOf('/foo/bar') === 0) {
      return req.session._csrf;
    } else {
      return connect.csrf.defaultValue(req);
    }
  }
});
```

Thanks. =)