Revert "req.session._csrf is deprecated, use req.csrfToken() instead"

This reverts commit 358b8fda6ba9331356c4dc9baad97948838638a5.