Support chaning req.session after csrf middleware

fixes #22