This didn't actually work when the csrf middleware is missing, because the csrfToken method was missing altogether.

I've made it work like this:

````
_csrf: req.csrfToken ? req.csrfToken() : false
````

and then only included the hidden field in the template if there is a `_csrf` value, so it's now optional - if the csrf middleware is included it will work, without it things are as they were before.