Upgrade express to close security vulnerabilities

Related issue: https://github.com/balderdashy/sails/issues/2070

Express 3.16.0 made some changes to its csrf logic and it now uses https://github.com/expressjs/csurf, so I had to update the Sails csrf hook to reflect those changes. The biggest change is that the express csrf() call actually throws a 403 error for invalid tokens instead of just returning the error like it used to. So I updated the hook to catch that error and then handle it the same from there.

I also updated the tests as needed, and they all pass.

Just let me know if this change should be made in `stable` instead of `master`.