csrf: force req.session._csrf to non-enumerable