CSRF protection

[dannycoates]

No description provided.

[dannycoates]

background: https://github.com/pillarjs/understanding-csrf

use https://www.npmjs.com/package/csurf

[abhinadduri]

We are currently using delete tokens to ensure that only the person who uploaded a file can delete it. These delete tokens are stored in local storage, and on our redis server. There are no other parts of the application where there could be a CSRF vulnerability (we don't have any type of user state, although I guess some sort of upload limit per browser would help stop stress attacks).