Express 4 drastically changes what's "built in"

so I added a section on what express 4.x wants vs. what 3.x wants, and refined your explanation on which CSRF functions to rely on