isaacs/npm-www — pull request #387 by evilpacket (2013-08-08 22:04:05+00:00)
Title: Don't use session for csrf token

the csrf-lite module will use whatever value you pass into it as the csrf token. In this case the csrf token was the HTTPOnly / secure session token. It's best practice to not take this value and then expose it to javascript and instead used a randomly generated value. I'm pretty sure this change does what we want.

Hat tip to Anton Abashkin for pointing this out in the csrf-lite example code which lead to @nlf identifying it here