curf package is deprecated

[git-antonyuk]

curf module is currently deprecated due to the large influx of security vulnerability reports received, most of which are simply exploiting the underlying limitations of CSRF itself. The Express.js project does not have the resources to put into this module, which is largely unnecessary for modern SPA-based applications.

Tech note:
Replace CSRF middleware with something workable, or write own solution

csurf