csrf: remove deletion of _csrf
csrf: make req.session._csrf non-enumerable
Merged w/ upstream.