Express 4 drastically changes what's "built in"

so I added a section on what express 4.x wants vs. what 3.x wants, and refined your explanation on which CSRF functions to rely on
Will throw a deprecation warning due to a missing `extended: true`, despite the fact that it defaults to true.