use req.csrfToken() to set cookie

As hinted in followup comments to your blog post, replace ```req.session._csrf``` by ```req.csrfToken()```.