use csrf-tokens@1

closes #7
2.0.0