csrf: remove deprecated req.session._csrf getter