replace express.csrf() by express.csurf()

As hinted also in one of the followup comments to your blog post, Step 2 "Telling CSRF middleware to use the right token" is not necessary anymore because express/connect-csurf already contains the extended value() function with
... || (req.headers['x-xsrf-token']);

see
 https://github.com/expressjs/csurf/blob/master/index.js