https://github.com/jaredhanson/passport-oauth2/issues/3 implies csrf built-in