refactor csrf code out of server.js and into helper