removed all uses of csrf, companion to nodebb/nodebb@ad9b2ca
0.1.39