Added CSRF middleware to server.js