WorkJS CSRF middleware