Use req.session.id as CSRF secret if it's present.

Rename req._csrf() to req.csrfToken(), req.session._csrf_secret to
req.session._csrfSecret.