put back express-init

packages/app/src/server/crowi/express-init.js

@@ -1,5 +1,7 @@
+import csrf from 'csurf';
 import mongoose from 'mongoose';
 
+
 // import { i18n, localePath } from '~/next-i18next.config';
 
 module.exports = function(crowi, app) {
@@ -119,6 +121,9 @@ module.exports = function(crowi, app) {
     sessionMiddleware(req, res, next);
   });
 
+  // csurf should be initialized after express-session
+  app.use(csrf({ cookie: false }));
+
   // passport
   debug('initialize Passport');
   app.use(passport.initialize());