New option for csrf
You can disable csrf for a route with module.exports.csrf.routesDisabled