Support changing req.session after csrf middleware

fixes #22