Update CSRF docs to use req.csrfToken()
Merge pull request #87 from venables/csrf-protection-update

Update CSRF docs to use `req.csrfToken()`