Add support for CSRF since Express 4.0 doesn't have the middleware included

Add the csurf library to the package.json, since it moved out of the express middleware. 

Add the csurf and CSRF support to the express.js file; however, it's commented out, so the developer can choose to enable it, if needed. 

The benefit of setting up CSRF support the way it's setup is now client-side you do not need any additional functionality to enable CSRF.