This doesn't seem like the right way to handle this. stats requests are only allowed for localhost, so CSRF is not an issue. I think what we really want is for the stats URL to be on a path that doesn't have most of the middleware of the main site.

This might be possible by defining the stats route in app.js before the `express.limit` middleware is applied.