changed call to csrfToken.  session._csrf is deprecated.
 resolved conflict
added cors to package.json