remove vhost
remove csrf
remove the old .createServer method
cookieSession: compare full value rather than crc32

fixes #1014
deps: raw-body@1.1.3

Pick up this fix: stream-utils/raw-body#14
2.13.1
Merge branch '2.13.x'
Update Readme.md
remove directory