Added csurf package since express 4.0 doesn't have csrf by default anymore

I added the [csurf](https://github.com/expressjs/csurf) package to the package.json file, so mean.io can now have support for CSRF out of the box. 

If the user wished to utilize CSRF it would be the exact same as in Express 3.0; however, they must add the following line:

```javascript
var csrf = require('csurf');
```