add middleware to store csrf token in res.locals