use err.status instead of res.statusCode
removed csrf stuff
release 0.2.15