csrf protection

depends on client-sessions pull request
(or we could just use express.cookieSession(), but i prefer
client-sessions)

fixes #26
Merge pull request #30 from callahad/csrf

Csrf