csrf: force req.session._csrf to non-enumerable
2.13.0
Merge branch '2.x'
remove session middleware
remove fresh from deps
remove favicon
remove more session stuff
remove cache
remove query middleware
some linting