csrf: force req.session._csrf to non-enumerable
2.13.0
Merge branch '2.x'