[fix] csrf works for express >=3.3.8 properly
[feature] - freeze express version to >=3.3.8