Updated to express 3.4.0

Just if you want to update to express 3.4, req.session._csrf becomes req.csrfToken()