Update CSRF docs to use `req.csrfToken()`

This updates the CSRF middleware documenation to use `req.csrfToken()` instead of the deprecated `req.session._csrf` property, per issue [#1741](https://github.com/visionmedia/express/issues/1741).