no deprecation warning when JSON.stringifying session

I'm getting extreme numbers of deprecation warnings from the session middleware's JSON.stringification of req.session. This change removes the _csrf property (only there for deprecation warnings) from that listing.