The security best practices page suggests that we want to be using CSRF protection, and that seems like an awfully good idea.  https://github.com/mozilla/browserid-cookbook/blob/master/node-express/app.js uses express.csrf(), which looks like it might entrain express.session(), among other things. I'm not sure how invasive of a change this would be.  We could conceivably put it off to another card, I suppose.  Another thing we might want to consider, either now or (more likely) in the future, would be using some of the express middleware that already exists for persona integration <https://developer.mozilla.org/en-US/docs/Mozilla/Persona/Libraries_and_plugins?redirectlocale=en-US&redirectslug=Persona%2FLibraries_and_plugins#Node.js>.