User based CSRF protection middleware for Express