Doh, we're not in Sinatra's context here
Add tests for the CSRF middleware