Remove reference to req.csrfToken in CORS hook