pin external dependencies to please @dougwilson
csrf-tokens -> csrf
2.0.1