Add CSRF protection to modifiable examples

Provides an example of how to do CSRF protection use [csurf](https://github.com/expressjs/csurf). By default, csurf uses the `_csrf` query param for passing the token back to the server.