MERGED

32 files changed, 1685 insertions, 0 deletions

diff --git a/node_modules/csrf/HISTORY.md b/node_modules/csrf/HISTORY.md
new file mode 100644
index 0000000..cbccedf
--- /dev/null
+++ b/node_modules/csrf/HISTORY.md
@@ -0,0 +1,86 @@
+3.0.3 / 2016-05-26
+==================
+
+  * deps: tsscmp@1.0.5
+
+3.0.2 / 2016-05-22
+==================
+
+  * Use `tsscmp` module for timing-safe token verification
+  * deps: base64-url@1.2.2
+  * deps: uid-safe@2.1.1
+    - deps: base64-url@1.2.2
+
+3.0.1 / 2016-01-28
+==================
+
+  * deps: rndm@1.2.0
+  * deps: uid-safe@2.1.0
+    - Use `random-bytes` for byte source
+
+3.0.0 / 2015-05-09
+==================
+
+  * Remove `tokenize` export
+  * Remove `tokenize` option
+  * Return a prototype-based object rather than functions
+    - This means the resulting functions need to be called as methods
+  * Throw when missing secret to `tokens.create()`
+  * deps: uid-safe@~2.0.0
+    - Use global `Promise` when returning a promise
+
+2.0.7 / 2015-05-03
+==================
+
+  * Fix compatibility with `crypto.DEFAULT_ENCODING` global changes
+
+2.0.6 / 2015-02-13
+==================
+
+  * deps: base64-url@1.2.1
+  * deps: uid-safe@~1.1.0
+    - Use `crypto.randomBytes`, if available
+    - deps: base64-url@1.2.1
+
+2.0.5 / 2015-01-31
+==================
+
+  * deps: base64-url@1.2.0
+  * deps: uid-safe@~1.0.3
+    - Fix error branch that would throw
+    - deps: base64-url@1.2.0
+
+2.0.4 / 2015-01-08
+==================
+
+  * deps: uid-safe@~1.0.2
+    - Remove dependency on `mz`
+
+2.0.3 / 2014-12-30
+==================
+
+  * Slight speed improvement for `verify`
+  * deps: base64-url@1.1.0
+  * deps: rndm@~1.1.0
+
+2.0.2 / 2014-11-09
+==================
+
+  * deps: scmp@1.0.0
+
+2.0.1 / 2014-08-22
+==================
+
+  * Rename module to `csrf`
+
+2.0.0 / 2014-06-18
+==================
+
+  * Use `uid-safe` module
+  * Use `base64-url` module
+  * Remove sync `.secret()` -- use `.secretSync()` instead
+
+1.0.4 / 2014-06-11
+==================
+
+  * Make sure CSRF tokens are URL safe
diff --git a/node_modules/csrf/LICENSE b/node_modules/csrf/LICENSE
new file mode 100644
index 0000000..6b774b4
--- /dev/null
+++ b/node_modules/csrf/LICENSE
@@ -0,0 +1,22 @@
+The MIT License (MIT)
+
+Copyright (c) 2014 Jonathan Ong <me@jongleberry.com>
+Copyright (c) 2015 Douglas Christopher Wilson <doug@somethingdoug.com>
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
diff --git a/node_modules/csrf/README.md b/node_modules/csrf/README.md
new file mode 100644
index 0000000..537a02a
--- /dev/null
+++ b/node_modules/csrf/README.md
@@ -0,0 +1,126 @@
+# CSRF
+
+[![NPM Version][npm-image]][npm-url]
+[![NPM Downloads][downloads-image]][downloads-url]
+[![Node.js Version][node-image]][node-url]
+[![Build Status][travis-image]][travis-url]
+[![Test Coverage][coveralls-image]][coveralls-url]
+
+Logic behind CSRF token creation and verification.
+
+Read [Understanding-CSRF](https://github.com/pillarjs/understanding-csrf)
+for more information on CSRF. Use this module to create custom CSRF middleware.
+
+Looking for a CSRF framework for your favorite framework that uses this
+module?
+
+  * Express/connect: [csurf](https://www.npmjs.com/package/csurf) or
+    [alt-xsrf](https://www.npmjs.com/package/alt-xsrf)
+  * Koa: [koa-csrf](https://www.npmjs.com/package/koa-csrf) or
+    [koa-atomic-session](https://www.npmjs.com/package/koa-atomic-session)
+
+### Install
+
+```bash
+$ npm install csrf
+```
+
+## API
+
+```js
+var Tokens = require('csrf')
+```
+
+### new Tokens([options])
+
+Create a new token generation/verification instance. The `options` argument is
+optional and will just use all defaults if missing.
+
+#### Options
+
+Tokens accepts these properties in the options object.
+
+##### saltLength
+
+The length of the internal salt to use, in characters. Internally, the salt
+is a base 62 string. Defaults to `8` characters.
+
+##### secretLength
+
+The length of the secret to generate, in bytes. Note that the secret is
+passed around base-64 encoded and that this length refers to the underlying
+bytes, not the length of the base-64 string. Defaults to `18` bytes.
+
+#### tokens.create(secret)
+
+Create a new CSRF token attached to the given `secret`. The `secret` is a
+string, typically generated from the `tokens.secret()` or `tokens.secretSync()`
+methods. This token is what you should add into HTML `<form>` blocks and
+expect the user's browser to provide back.
+
+```js
+var secret = tokens.secretSync()
+var token = tokens.create(secret)
+```
+
+#### tokens.secret(callback)
+
+Asynchronously create a new `secret`, which is a string. The secret is to
+be kept on the server, typically stored in a server-side session for the
+user. The secret should be at least per user.
+
+```js
+tokens.secret(function (err, secret) {
+  if (err) throw err
+  // do something with the secret
+})
+```
+
+#### tokens.secret()
+
+Asynchronously create a new `secret` and return a `Promise`. Please see
+`tokens.secret(callback)` documentation for full details.
+
+**Note**: To use promises in Node.js _prior to 0.12_, promises must be
+"polyfilled" using `global.Promise = require('bluebird')`.
+
+```js
+tokens.secret().then(function (secret) {
+  // do something with the secret
+})
+```
+
+#### tokens.secretSync()
+
+A synchronous version of `tokens.secret(callback)`. Please see
+`tokens.secret(callback)` documentation for full details.
+
+```js
+var secret = tokens.secretSync()
+```
+
+#### tokens.verify(secret, token)
+
+Check whether a CSRF token is valid for the given `secret`, returning
+a Boolean.
+
+```js
+if (!tokens.verify(secret, token)) {
+  throw new Error('invalid token!')
+}
+```
+
+## License
+
+[MIT](LICENSE)
+
+[npm-image]: https://img.shields.io/npm/v/csrf.svg
+[npm-url]: https://npmjs.org/package/csrf
+[node-image]: https://img.shields.io/node/v/csrf.svg
+[node-url]: https://nodejs.org/en/download/
+[travis-image]: https://img.shields.io/travis/pillarjs/csrf/master.svg
+[travis-url]: https://travis-ci.org/pillarjs/csrf
+[coveralls-image]: https://img.shields.io/coveralls/pillarjs/csrf/master.svg
+[coveralls-url]: https://coveralls.io/r/pillarjs/csrf?branch=master
+[downloads-image]: https://img.shields.io/npm/dm/csrf.svg
+[downloads-url]: https://npmjs.org/package/csrf
diff --git a/node_modules/csrf/index.js b/node_modules/csrf/index.js
new file mode 100644
index 0000000..9b252cd
--- /dev/null
+++ b/node_modules/csrf/index.js
@@ -0,0 +1,139 @@
+/*!
+ * csrf
+ * Copyright(c) 2014 Jonathan Ong
+ * Copyright(c) 2015 Douglas Christopher Wilson
+ * MIT Licensed
+ */
+
+'use strict'
+
+/**
+ * Module dependencies.
+ * @private
+ */
+
+var rndm = require('rndm')
+var uid = require('uid-safe')
+var compare = require('tsscmp')
+var crypto = require('crypto')
+var escape = require('base64-url').escape
+
+/**
+ * Module exports.
+ * @public
+ */
+
+module.exports = Tokens
+
+/**
+ * Token generation/verification class.
+ *
+ * @param {object} [options]
+ * @param {number} [options.saltLength=8] The string length of the salt
+ * @param {number} [options.secretLength=18] The byte length of the secret key
+ * @public
+ */
+
+function Tokens (options) {
+  if (!(this instanceof Tokens)) {
+    return new Tokens(options)
+  }
+
+  var opts = options || {}
+
+  var saltLength = opts.saltLength !== undefined
+    ? opts.saltLength
+    : 8
+
+  if (typeof saltLength !== 'number' || !isFinite(saltLength) || saltLength < 1) {
+    throw new TypeError('option saltLength must be finite number > 1')
+  }
+
+  var secretLength = opts.secretLength !== undefined
+    ? opts.secretLength
+    : 18
+
+  if (typeof secretLength !== 'number' || !isFinite(secretLength) || secretLength < 1) {
+    throw new TypeError('option secretLength must be finite number > 1')
+  }
+
+  this.saltLength = saltLength
+  this.secretLength = secretLength
+}
+
+/**
+ * Create a new CSRF token.
+ *
+ * @param {string} secret The secret for the token.
+ * @public
+ */
+
+Tokens.prototype.create = function create (secret) {
+  if (!secret || typeof secret !== 'string') {
+    throw new TypeError('argument secret is required')
+  }
+
+  return this._tokenize(secret, rndm(this.saltLength))
+}
+
+/**
+ * Create a new secret key.
+ *
+ * @param {function} [callback]
+ * @public
+ */
+
+Tokens.prototype.secret = function secret (callback) {
+  return uid(this.secretLength, callback)
+}
+
+/**
+ * Create a new secret key synchronously.
+ * @public
+ */
+
+Tokens.prototype.secretSync = function secretSync () {
+  return uid.sync(this.secretLength)
+}
+
+/**
+ * Tokenize a secret and salt.
+ * @private
+ */
+
+Tokens.prototype._tokenize = function tokenize (secret, salt) {
+  var hash = crypto
+    .createHash('sha1')
+    .update(salt + '-' + secret, 'ascii')
+    .digest('base64')
+  return escape(salt + '-' + hash)
+}
+
+/**
+ * Verify if a given token is valid for a given secret.
+ *
+ * @param {string} secret
+ * @param {string} token
+ * @public
+ */
+
+Tokens.prototype.verify = function verify (secret, token) {
+  if (!secret || typeof secret !== 'string') {
+    return false
+  }
+
+  if (!token || typeof token !== 'string') {
+    return false
+  }
+
+  var index = token.indexOf('-')
+
+  if (index === -1) {
+    return false
+  }
+
+  var salt = token.substr(0, index)
+  var expected = this._tokenize(secret, salt)
+
+  return compare(token, expected)
+}
diff --git a/node_modules/csrf/node_modules/base64-url/LICENSE b/node_modules/csrf/node_modules/base64-url/LICENSE
new file mode 100644
index 0000000..9549143
--- /dev/null
+++ b/node_modules/csrf/node_modules/base64-url/LICENSE
@@ -0,0 +1,15 @@
+The ISC License
+
+Copyright (c) 2014, Joaquim José F. Serafim
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
+IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
diff --git a/node_modules/csrf/node_modules/base64-url/README.md b/node_modules/csrf/node_modules/base64-url/README.md
new file mode 100644
index 0000000..d9368c8
--- /dev/null
+++ b/node_modules/csrf/node_modules/base64-url/README.md
@@ -0,0 +1,55 @@
+# base64-url
+
+Base64 encode, decode, escape and unescape for URL applications.
+
+<a href="https://nodei.co/npm/base64-url/"><img src="https://nodei.co/npm/base64-url.png?downloads=true"></a>
+
+[![Build Status](https://travis-ci.org/joaquimserafim/base64-url.png?branch=master)](https://travis-ci.org/joaquimserafim/base64-url)
+
+
+## API
+
+```js
+base64url.encode('Node.js is awesome.');
+// returns Tm9kZS5qcyBpcyBhd2Vzb21lLg
+
+base64url.decode('Tm9kZS5qcyBpcyBhd2Vzb21lLg');
+// returns Node.js is awesome.
+
+base64url.escape('This+is/goingto+escape==');
+// returns This-is_goingto-escape
+
+base64url.unescape('This-is_goingto-escape');
+// returns This+is/goingto+escape==
+```
+
+
+## Development
+
+**this projet has been set up with a precommit that forces you to follow a code style, no jshint issues and 100% of code coverage before commit**
+
+
+to run test
+``` js
+npm test
+```
+
+to run jshint
+``` js
+npm run jshint
+```
+
+to run code style
+``` js
+npm run code-style
+```
+
+to check code coverage
+``` js
+npm run check-coverage
+```
+
+to open the code coverage report
+``` js
+npm run coverage
+```
diff --git a/node_modules/csrf/node_modules/base64-url/index.js b/node_modules/csrf/node_modules/base64-url/index.js
new file mode 100644
index 0000000..34968ae
--- /dev/null
+++ b/node_modules/csrf/node_modules/base64-url/index.js
@@ -0,0 +1,24 @@
+'use strict';
+
+var base64url = module.exports;
+
+base64url.unescape = function unescape (str) {
+  return (str + Array(5 - str.length % 4)
+    .join('='))
+    .replace(/\-/g, '+')
+    .replace(/_/g, '/');
+};
+
+base64url.escape = function escape (str) {
+  return str.replace(/\+/g, '-')
+    .replace(/\//g, '_')
+    .replace(/=/g, '');
+};
+
+base64url.encode = function encode (str) {
+  return this.escape(new Buffer(str).toString('base64'));
+};
+
+base64url.decode = function decode (str) {
+  return new Buffer(this.unescape(str), 'base64').toString();
+};
diff --git a/node_modules/csrf/node_modules/base64-url/package.json b/node_modules/csrf/node_modules/base64-url/package.json
new file mode 100644
index 0000000..ab95386
--- /dev/null
+++ b/node_modules/csrf/node_modules/base64-url/package.json
@@ -0,0 +1,75 @@
+{
+  "name": "base64-url",
+  "version": "1.2.2",
+  "description": "Base64 encode, decode, escape and unescape for URL applications",
+  "main": "index.js",
+  "files": [
+    "LICENSE",
+    "README.md",
+    "index.js"
+  ],
+  "scripts": {
+    "test": "istanbul cover tape test.js",
+    "jshint": "jshint -c .jshintrc *.js",
+    "code-style": "jscs -p google *.js",
+    "check-coverage": "istanbul check-coverage --statements 100 --functions 100 --lines 100 --branches 100",
+    "coverage": "open coverage/lcov-report/index.html"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git://github.com/joaquimserafim/base64-url.git"
+  },
+  "keywords": [
+    "base64",
+    "base64url"
+  ],
+  "author": {
+    "name": "@joaquimserafim"
+  },
+  "license": "ISC",
+  "bugs": {
+    "url": "https://github.com/joaquimserafim/base64-url/issues"
+  },
+  "homepage": "https://github.com/joaquimserafim/base64-url",
+  "devDependencies": {
+    "istanbul": "^0.3.5",
+    "jscs": "^1.9.0",
+    "jshint": "^2.5.11",
+    "pre-commit": "0.0.9",
+    "tape": "^3.0.3",
+    "which": "^1.0.8"
+  },
+  "pre-commit": [
+    "jshint",
+    "code-style",
+    "test",
+    "check-coverage"
+  ],
+  "gitHead": "7e5b7e351edbf67ed04e3475663d3a64e0c32035",
+  "_id": "base64-url@1.2.2",
+  "_shasum": "90af26ef8b0b67bc801b05eccf943345649008b3",
+  "_from": "base64-url@1.2.2",
+  "_npmVersion": "2.15.0",
+  "_nodeVersion": "4.4.2",
+  "_npmUser": {
+    "name": "quim",
+    "email": "joaquim.serafim@gmail.com"
+  },
+  "dist": {
+    "shasum": "90af26ef8b0b67bc801b05eccf943345649008b3",
+    "tarball": "https://registry.npmjs.org/base64-url/-/base64-url-1.2.2.tgz"
+  },
+  "maintainers": [
+    {
+      "name": "quim",
+      "email": "joaquim.serafim@gmail.com"
+    }
+  ],
+  "_npmOperationalInternal": {
+    "host": "packages-12-west.internal.npmjs.com",
+    "tmp": "tmp/base64-url-1.2.2.tgz_1459642531916_0.0884270598180592"
+  },
+  "directories": {},
+  "_resolved": "https://registry.npmjs.org/base64-url/-/base64-url-1.2.2.tgz",
+  "readme": "ERROR: No README data found!"
+}
diff --git a/node_modules/csrf/node_modules/rndm/LICENSE b/node_modules/csrf/node_modules/rndm/LICENSE
new file mode 100644
index 0000000..a7ae8ee
--- /dev/null
+++ b/node_modules/csrf/node_modules/rndm/LICENSE
@@ -0,0 +1,22 @@
+
+The MIT License (MIT)
+
+Copyright (c) 2014 Jonathan Ong me@jongleberry.com
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
diff --git a/node_modules/csrf/node_modules/rndm/README.md b/node_modules/csrf/node_modules/rndm/README.md
new file mode 100644
index 0000000..504b1fd
--- /dev/null
+++ b/node_modules/csrf/node_modules/rndm/README.md
@@ -0,0 +1,27 @@
+
+# RNDM
+
+Random string generator.
+Basically `Math.random().toString(36).slice(2)`,
+but with both upper and lower case letters and arbitrary lengths.
+Useful for creating fast, not cryptographically secure salts.
+
+## API
+
+```js
+// base62 by default
+var rndm = require('rndm')
+var salt = rndm(16)
+```
+
+### var salt = rndm(length)
+
+### var salt = rndm.base62(length)
+
+### var salt = rndm.base36(length)
+
+### var salt = rndm.base10(length)
+
+### var random = rndm.create(characters)
+
+Create a new random generator with custom characters.
diff --git a/node_modules/csrf/node_modules/rndm/index.js b/node_modules/csrf/node_modules/rndm/index.js
new file mode 100644
index 0000000..24b0ebb
--- /dev/null
+++ b/node_modules/csrf/node_modules/rndm/index.js
@@ -0,0 +1,25 @@
+
+var assert = require('assert')
+
+var base62 = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789'
+var base36 = 'abcdefghijklmnopqrstuvwxyz0123456789'
+var base10 = '0123456789'
+
+exports = module.exports = create(base62)
+exports.base62 = exports
+exports.base36 = create(base36)
+exports.base10 = create(base10)
+
+exports.create = create
+
+function create(chars) {
+  assert(typeof chars === 'string', 'the list of characters must be a string!')
+  var length = Buffer.byteLength(chars)
+  return function rndm(len) {
+    len = len || 10
+    assert(typeof len === 'number' && len >= 0, 'the length of the random string must be a number!')
+    var salt = ''
+    for (var i = 0; i < len; i++) salt += chars[Math.floor(length * Math.random())]
+    return salt
+  }
+}
diff --git a/node_modules/csrf/node_modules/rndm/package.json b/node_modules/csrf/node_modules/rndm/package.json
new file mode 100644
index 0000000..191f461
--- /dev/null
+++ b/node_modules/csrf/node_modules/rndm/package.json
@@ -0,0 +1,73 @@
+{
+  "name": "rndm",
+  "description": "random string generator",
+  "version": "1.2.0",
+  "author": {
+    "name": "Jonathan Ong",
+    "email": "me@jongleberry.com",
+    "url": "http://jongleberry.com"
+  },
+  "license": "MIT",
+  "devDependencies": {
+    "mocha": "2",
+    "istanbul": "0"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/crypto-utils/rndm.git"
+  },
+  "scripts": {
+    "test": "mocha",
+    "test-cov": "istanbul cover node_modules/mocha/bin/_mocha -- --reporter dot",
+    "test-travis": "istanbul cover node_modules/mocha/bin/_mocha --report lcovonly -- --reporter dot"
+  },
+  "keywords": [
+    "random",
+    "number",
+    "generator",
+    "uid",
+    "id"
+  ],
+  "files": [
+    "index.js"
+  ],
+  "gitHead": "9d566c844a4c83487f3b2621be5b6588d5a2b617",
+  "bugs": {
+    "url": "https://github.com/crypto-utils/rndm/issues"
+  },
+  "homepage": "https://github.com/crypto-utils/rndm#readme",
+  "_id": "rndm@1.2.0",
+  "_shasum": "f33fe9cfb52bbfd520aa18323bc65db110a1b76c",
+  "_from": "rndm@1.2.0",
+  "_npmVersion": "2.14.4",
+  "_nodeVersion": "4.1.1",
+  "_npmUser": {
+    "name": "coderhaoxin",
+    "email": "coderhaoxin@outlook.com"
+  },
+  "maintainers": [
+    {
+      "name": "coderhaoxin",
+      "email": "coderhaoxin@outlook.com"
+    },
+    {
+      "name": "dougwilson",
+      "email": "doug@somethingdoug.com"
+    },
+    {
+      "name": "fishrock123",
+      "email": "fishrock123@rocketmail.com"
+    },
+    {
+      "name": "jongleberry",
+      "email": "jonathanrichardong@gmail.com"
+    }
+  ],
+  "dist": {
+    "shasum": "f33fe9cfb52bbfd520aa18323bc65db110a1b76c",
+    "tarball": "https://registry.npmjs.org/rndm/-/rndm-1.2.0.tgz"
+  },
+  "directories": {},
+  "_resolved": "https://registry.npmjs.org/rndm/-/rndm-1.2.0.tgz",
+  "readme": "ERROR: No README data found!"
+}
diff --git a/node_modules/csrf/node_modules/tsscmp/.npmignore b/node_modules/csrf/node_modules/tsscmp/.npmignore
new file mode 100644
index 0000000..c2658d7
--- /dev/null
+++ b/node_modules/csrf/node_modules/tsscmp/.npmignore
@@ -0,0 +1 @@
+node_modules/
diff --git a/node_modules/csrf/node_modules/tsscmp/.travis.yml b/node_modules/csrf/node_modules/tsscmp/.travis.yml
new file mode 100644
index 0000000..b85d89f
--- /dev/null
+++ b/node_modules/csrf/node_modules/tsscmp/.travis.yml
@@ -0,0 +1,14 @@
+language: node_js
+node_js:
+  - "6"
+  - "5"
+  - "5.1"
+  - "4"
+  - "4.2"
+  - "4.1"
+  - "4.0"
+  - "0.12"
+  - "0.11"
+  - "0.10"
+  - "0.8"
+  - "0.6"
diff --git a/node_modules/csrf/node_modules/tsscmp/LICENSE b/node_modules/csrf/node_modules/tsscmp/LICENSE
new file mode 100644
index 0000000..c62e51b
--- /dev/null
+++ b/node_modules/csrf/node_modules/tsscmp/LICENSE
@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2016
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
diff --git a/node_modules/csrf/node_modules/tsscmp/README.md b/node_modules/csrf/node_modules/tsscmp/README.md
new file mode 100644
index 0000000..cba99d0
--- /dev/null
+++ b/node_modules/csrf/node_modules/tsscmp/README.md
@@ -0,0 +1,48 @@
+# Timing safe string compare using double HMAC
+
+[![Node.js Version](https://img.shields.io/node/v/tsscmp.svg?style=flat-square)](https://nodejs.org/en/download)
+[![npm](https://img.shields.io/npm/v/tsscmp.svg?style=flat-square)](https://npmjs.org/package/tsscmp)
+[![NPM Downloads](https://img.shields.io/npm/dm/tsscmp.svg?style=flat-square)](https://npmjs.org/package/tsscmp)
+[![Build Status](https://img.shields.io/travis/suryagh/tsscmp/master.svg?style=flat-square)](https://travis-ci.org/suryagh/tsscmp)
+[![Build Status](https://img.shields.io/appveyor/ci/suryagh/tsscmp/master.svg?style=flat-square&label=windows)](https://ci.appveyor.com/project/suryagh/tsscmp)
+[![Dependency Status](http://img.shields.io/david/suryagh/tsscmp.svg?style=flat-square)](https://david-dm.org/suryagh/tsscmp)
+[![npm-license](http://img.shields.io/npm/l/tsscmp.svg?style=flat-square)](LICENSE)
+
+
+Prevents [timing attacks](http://codahale.com/a-lesson-in-timing-attacks/) using Brad Hill's
+[Double HMAC pattern](https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2011/february/double-hmac-verification/)
+to perform secure string comparison. Double HMAC avoids the timing atacks by blinding the
+timing channel using random time per attempt comparison against iterative brute force attacks.
+
+
+## Install
+
+```
+npm install tsscmp
+```
+## Why
+To compare secret values like **authentication tokens**, **passwords** or
+**capability urls** so that timing information is not
+leaked to the attacker.
+
+## Example
+
+```js
+var timingSafeCompare = require('tsscmp');
+
+var sessionToken = '127e6fbfe24a750e72930c';
+var givenToken = '127e6fbfe24a750e72930c';
+
+if (timingSafeCompare(sessionToken, givenToken)) {
+  console.log('good token');
+} else {
+  console.log('bad token');
+}
+```
+##License: 
+[MIT](LICENSE)
+
+**Credits to:**  [@jsha](https://github.com/jsha) |
+[@bnoordhuis](https://github.com/bnoordhuis) |
+[@suryagh](https://github.com/suryagh) |
+ 
\ No newline at end of file
diff --git a/node_modules/csrf/node_modules/tsscmp/appveyor.yml b/node_modules/csrf/node_modules/tsscmp/appveyor.yml
new file mode 100644
index 0000000..29cd460
--- /dev/null
+++ b/node_modules/csrf/node_modules/tsscmp/appveyor.yml
@@ -0,0 +1,29 @@
+# Test against this version of Node.js
+environment:
+  matrix:
+   # nodejs_version: "0.6" not supported  in Windows x86
+   - nodejs_version: "0.8"
+   - nodejs_version: "0.10"
+   - nodejs_version: "0.11"
+   - nodejs_version: "0.12"
+   - nodejs_version: "4.0"
+   - nodejs_version: "5.0"
+   - nodejs_version: "6.0"
+
+# Install scripts. (runs after repo cloning)
+install:
+  # Get the latest stable version of Node.js or io.js
+  - ps: Install-Product node $env:nodejs_version
+  # install modules
+  - npm install
+
+# Post-install test scripts.
+test_script:
+  # Output useful info for debugging.
+  - node --version
+  - npm --version
+  # run tests
+  - npm test
+
+# Don't actually build.
+build: off
diff --git a/node_modules/csrf/node_modules/tsscmp/lib/index.js b/node_modules/csrf/node_modules/tsscmp/lib/index.js
new file mode 100644
index 0000000..7c86142
--- /dev/null
+++ b/node_modules/csrf/node_modules/tsscmp/lib/index.js
@@ -0,0 +1,33 @@
+'use strict';
+
+// Implements Brad Hill's Double HMAC pattern from
+// https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2011/february/double-hmac-verification/.
+// The approach is similar to the node's native implementation of timing safe buffer comparison that will be available on v6+.
+// https://github.com/nodejs/node/issues/3043
+// https://github.com/nodejs/node/pull/3073
+
+var crypto = require('crypto');
+
+function bufferEqual(a, b) {
+  if (a.length !== b.length) {
+    return false;
+  }
+  for (var i = 0; i < a.length; i++) {
+    if (a[i] !== b[i]) {
+      return false;
+    }
+  }
+  return true;
+}
+
+function timeSafeCompare(a, b) {
+  var sa = String(a);
+  var sb = String(b);
+  var key = crypto.pseudoRandomBytes(32);
+  var ah = crypto.createHmac('sha256', key).update(sa).digest();
+  var bh = crypto.createHmac('sha256', key).update(sb).digest();
+
+  return bufferEqual(ah, bh) && a === b;
+}
+
+module.exports = timeSafeCompare;
diff --git a/node_modules/csrf/node_modules/tsscmp/package.json b/node_modules/csrf/node_modules/tsscmp/package.json
new file mode 100644
index 0000000..6c6be76
--- /dev/null
+++ b/node_modules/csrf/node_modules/tsscmp/package.json
@@ -0,0 +1,62 @@
+{
+  "name": "tsscmp",
+  "version": "1.0.5",
+  "description": "Timing safe string compare using double HMAC",
+  "main": "lib/index.js",
+  "dependencies": {},
+  "devDependencies": {},
+  "scripts": {
+    "test": "node test/unit && node test/benchmark"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/suryagh/tsscmp.git"
+  },
+  "keywords": [
+    "timing safe string compare",
+    "double hmac string compare",
+    "safe string compare",
+    "hmac"
+  ],
+  "author": {
+    "name": "suryagh"
+  },
+  "publishConfig": {
+    "registry": "https://registry.npmjs.org"
+  },
+  "engines": {
+    "node": ">=0.6.x"
+  },
+  "license": "MIT",
+  "gitHead": "095fb02b3e6102cbd1d2bdc9613e3da54e782f59",
+  "bugs": {
+    "url": "https://github.com/suryagh/tsscmp/issues"
+  },
+  "homepage": "https://github.com/suryagh/tsscmp#readme",
+  "_id": "tsscmp@1.0.5",
+  "_shasum": "7dc4a33af71581ab4337da91d85ca5427ebd9a97",
+  "_from": "tsscmp@1.0.5",
+  "_npmVersion": "3.6.0",
+  "_nodeVersion": "5.6.0",
+  "_npmUser": {
+    "name": "suryagh",
+    "email": "surya.com@gmail.com"
+  },
+  "dist": {
+    "shasum": "7dc4a33af71581ab4337da91d85ca5427ebd9a97",
+    "tarball": "https://registry.npmjs.org/tsscmp/-/tsscmp-1.0.5.tgz"
+  },
+  "maintainers": [
+    {
+      "name": "suryagh",
+      "email": "surya.com@gmail.com"
+    }
+  ],
+  "_npmOperationalInternal": {
+    "host": "packages-16-east.internal.npmjs.com",
+    "tmp": "tmp/tsscmp-1.0.5.tgz_1464226502956_0.48576042777858675"
+  },
+  "directories": {},
+  "_resolved": "https://registry.npmjs.org/tsscmp/-/tsscmp-1.0.5.tgz",
+  "readme": "ERROR: No README data found!"
+}
diff --git a/node_modules/csrf/node_modules/tsscmp/test/benchmark/index.js b/node_modules/csrf/node_modules/tsscmp/test/benchmark/index.js
new file mode 100644
index 0000000..fd93e42
--- /dev/null
+++ b/node_modules/csrf/node_modules/tsscmp/test/benchmark/index.js
@@ -0,0 +1,30 @@
+'use strict';
+
+var timeSafeCompare = require('../../lib/index');
+
+function random(length) {
+
+    length = length || 32;
+    var result = "";
+    var possible = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789!@#$%^&*()-+/*[]{}-=\|;\':\"<>?,./";
+
+    for( var i=0; i < length; i++ ){
+        result += possible.charAt(Math.floor(Math.random() * possible.length));
+    }
+    return result;
+}
+
+function run(count) {
+    count = count || 100*1000;
+    console.log('benchmark count: ' + count/1000 + 'k');
+    console.time('benchmark');
+    
+    while(count--){
+        timeSafeCompare(random(), random());
+    }
+    console.timeEnd('benchmark');
+}
+
+run(100000);
+
+module.exports = run;
diff --git a/node_modules/csrf/node_modules/tsscmp/test/unit/index.js b/node_modules/csrf/node_modules/tsscmp/test/unit/index.js
new file mode 100644
index 0000000..0335423
--- /dev/null
+++ b/node_modules/csrf/node_modules/tsscmp/test/unit/index.js
@@ -0,0 +1,69 @@
+'use strict';
+
+var assert = require('assert');
+var timeSafeCompare = require('../../lib/index');
+
+process.on('error', function (e) {
+	console.log('caught: ' + e);
+});
+
+function testEqual(a, b) {
+	assert(timeSafeCompare(a, b));
+
+	// lets also do a parity check with the strict equal to operator
+	assert(a === b);
+}
+
+function testNotEqual(a, b) {
+	assert(!timeSafeCompare(a, b));
+
+	// lets also do a parity check with the strict not equal to operator
+	assert(a !== b);
+}
+
+// note: lets also make sure tsscmp can be inline replaced for any types -
+// just incase if anyone is interested
+
+// positive tests
+testEqual('127e6fbfe24a750e72930c220a8e138275656b8e5d8f48a98c3c92df2caba935',
+	'127e6fbfe24a750e72930c220a8e138275656b8e5d8f48a98c3c92df2caba935',
+	'test ');
+testEqual('a', 'a');
+testEqual('', '');
+testEqual(undefined, undefined);
+testEqual(true, true);
+testEqual(false, false);
+(function () {
+	var a = { a: 1 };
+	testEqual(a, a);
+})();
+(function () {
+	function f1() { return 1; };
+	testEqual(f1, f1);
+})();
+
+// negative tests
+testNotEqual('');
+testNotEqual('a', 'b');
+testNotEqual('a', 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa');
+testNotEqual('aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa', 'a');
+testNotEqual('alpha', 'beta');
+testNotEqual(false, true);
+testNotEqual(false, undefined);
+testNotEqual(function () { }, function () { });
+testNotEqual({}, {});
+testNotEqual({ a: 1 }, { a: 1 });
+testNotEqual({ a: 1 }, { a: 2 });
+testNotEqual([1, 2], [1, 2]);
+testNotEqual([1, 2], [1, 2, 3]);
+(function () {
+	var a = { p: 1 };
+	var b = { p: 1 };
+	testNotEqual(a, b);
+})();
+(function () {
+	function f1() { return 1; };
+	function f2() { return 1; };
+	testNotEqual(f1, f2);
+})();
+console.log('Success: all tests complete.');
diff --git a/node_modules/csrf/node_modules/uid-safe/HISTORY.md b/node_modules/csrf/node_modules/uid-safe/HISTORY.md
new file mode 100644
index 0000000..365c92f
--- /dev/null
+++ b/node_modules/csrf/node_modules/uid-safe/HISTORY.md
@@ -0,0 +1,41 @@
+2.1.1 / 2016-05-04
+==================
+
+  * deps: base64-url@1.2.2
+
+2.1.0 / 2016-01-17
+==================
+
+  * Use `random-bytes` for byte source
+
+2.0.0 / 2015-05-08
+==================
+
+  * Use global `Promise` when returning a promise
+
+1.1.0 / 2015-02-01
+==================
+
+  * Use `crypto.randomBytes`, if available
+  * deps: base64-url@1.2.1
+
+1.0.3 / 2015-01-31
+==================
+
+  * Fix error branch that would throw
+  * deps: base64-url@1.2.0
+
+1.0.2 / 2015-01-08
+==================
+
+  * Remove dependency on `mz`
+
+1.0.1 / 2014-06-18
+==================
+
+  * Remove direct `bluebird` dependency
+
+1.0.0 / 2014-06-18
+==================
+
+  * Initial release
diff --git a/node_modules/csrf/node_modules/uid-safe/LICENSE b/node_modules/csrf/node_modules/uid-safe/LICENSE
new file mode 100644
index 0000000..7a7a4e1
--- /dev/null
+++ b/node_modules/csrf/node_modules/uid-safe/LICENSE
@@ -0,0 +1,22 @@
+The MIT License (MIT)
+
+Copyright (c) 2014 Jonathan Ong <me@jongleberry.com>
+Copyright (c) 2015-2016 Douglas Christopher Wilson <doug@somethingdoug.com>
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
diff --git a/node_modules/csrf/node_modules/uid-safe/README.md b/node_modules/csrf/node_modules/uid-safe/README.md
new file mode 100644
index 0000000..fa02be8
--- /dev/null
+++ b/node_modules/csrf/node_modules/uid-safe/README.md
@@ -0,0 +1,77 @@
+# uid-safe
+
+[![NPM Version][npm-image]][npm-url]
+[![NPM Downloads][downloads-image]][downloads-url]
+[![Node.js Version][node-version-image]][node-version-url]
+[![Build Status][travis-image]][travis-url]
+[![Test Coverage][coveralls-image]][coveralls-url]
+
+URL and cookie safe UIDs
+
+Create cryptographically secure UIDs safe for both cookie and URL usage.
+This is in contrast to modules such as [rand-token](https://www.npmjs.com/package/rand-token)
+and [uid2](https://www.npmjs.com/package/uid2) whose UIDs are actually skewed
+due to the use of `%` and unnecessarily truncate the UID.
+Use this if you could still use UIDs with `-` and `_` in them.
+
+## Installation
+
+```sh
+$ npm install uid-safe
+```
+
+## API
+
+```js
+var uid = require('uid-safe')
+```
+
+### uid(byteLength, callback)
+
+Asynchronously create a UID with a specific byte length. Because `base64`
+encoding is used underneath, this is not the string length. For example,
+to create a UID of length 24, you want a byte length of 18.
+
+```js
+uid(18, function (err, string) {
+  if (err) throw err
+  // do something with the string
+})
+```
+
+### uid(byteLength)
+
+Asynchronously create a UID with a specific byte length and return a
+`Promise`.
+
+**Note**: To use promises in Node.js _prior to 0.12_, promises must be
+"polyfilled" using `global.Promise = require('bluebird')`.
+
+```js
+uid(18).then(function (string) {
+  // do something with the string
+})
+```
+
+### uid.sync(byteLength)
+
+A synchronous version of above.
+
+```js
+var string = uid.sync(18)
+```
+
+## License
+
+[MIT](LICENSE)
+
+[npm-image]: https://img.shields.io/npm/v/uid-safe.svg
+[npm-url]: https://npmjs.org/package/uid-safe
+[node-version-image]: https://img.shields.io/node/v/uid-safe.svg
+[node-version-url]: https://nodejs.org/en/download/
+[travis-image]: https://img.shields.io/travis/crypto-utils/uid-safe/master.svg
+[travis-url]: https://travis-ci.org/crypto-utils/uid-safe
+[coveralls-image]: https://img.shields.io/coveralls/crypto-utils/uid-safe/master.svg
+[coveralls-url]: https://coveralls.io/r/crypto-utils/uid-safe?branch=master
+[downloads-image]: https://img.shields.io/npm/dm/uid-safe.svg
+[downloads-url]: https://npmjs.org/package/uid-safe
diff --git a/node_modules/csrf/node_modules/uid-safe/index.js b/node_modules/csrf/node_modules/uid-safe/index.js
new file mode 100644
index 0000000..9bef704
--- /dev/null
+++ b/node_modules/csrf/node_modules/uid-safe/index.js
@@ -0,0 +1,96 @@
+/*!
+ * uid-safe
+ * Copyright(c) 2014 Jonathan Ong
+ * Copyright(c) 2015-2016 Douglas Christopher Wilson
+ * MIT Licensed
+ */
+
+'use strict'
+
+/**
+ * Module dependencies.
+ * @private
+ */
+
+var escape = require('base64-url').escape
+var randomBytes = require('random-bytes')
+
+/**
+ * Module exports.
+ * @public
+ */
+
+module.exports = uid
+module.exports.sync = uidSync
+
+/**
+ * Create a unique ID.
+ *
+ * @param {number} length
+ * @param {function} [callback]
+ * @return {Promise}
+ * @public
+ */
+
+function uid(length, callback) {
+  // validate callback is a function, if provided
+  if (callback !== undefined && typeof callback !== 'function') {
+    throw new TypeError('argument callback must be a function')
+  }
+
+  // require the callback without promises
+  if (!callback && !global.Promise) {
+    throw new TypeError('argument callback is required')
+  }
+
+  if (callback) {
+    // classic callback style
+    return generateUid(length, callback)
+  }
+
+  return new Promise(function executor(resolve, reject) {
+    generateUid(length, function onUid(err, str) {
+      if (err) return reject(err)
+      resolve(str)
+    })
+  })
+}
+
+/**
+ * Create a unique ID sync.
+ *
+ * @param {number} length
+ * @return {string}
+ * @public
+ */
+
+function uidSync(length) {
+  return toString(randomBytes.sync(length))
+}
+
+/**
+ * Generate a unique ID string.
+ *
+ * @param {number} length
+ * @param {function} callback
+ * @private
+ */
+
+function generateUid(length, callback) {
+  randomBytes(length, function (err, buf) {
+    if (err) return callback(err)
+    callback(null, toString(buf))
+  })
+}
+
+/**
+ * Change a Buffer into a string.
+ *
+ * @param {Buffer} buf
+ * @return {string}
+ * @private
+ */
+
+function toString(buf) {
+  return escape(buf.toString('base64'))
+}
diff --git a/node_modules/csrf/node_modules/uid-safe/node_modules/random-bytes/HISTORY.md b/node_modules/csrf/node_modules/uid-safe/node_modules/random-bytes/HISTORY.md
new file mode 100644
index 0000000..8cabd9d
--- /dev/null
+++ b/node_modules/csrf/node_modules/uid-safe/node_modules/random-bytes/HISTORY.md
@@ -0,0 +1,4 @@
+1.0.0 / 2016-01-17
+==================
+
+  * Initial release
diff --git a/node_modules/csrf/node_modules/uid-safe/node_modules/random-bytes/LICENSE b/node_modules/csrf/node_modules/uid-safe/node_modules/random-bytes/LICENSE
new file mode 100644
index 0000000..c24dbe3
--- /dev/null
+++ b/node_modules/csrf/node_modules/uid-safe/node_modules/random-bytes/LICENSE
@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2016 Douglas Christopher Wilson <doug@somethingdoug.com>
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
diff --git a/node_modules/csrf/node_modules/uid-safe/node_modules/random-bytes/README.md b/node_modules/csrf/node_modules/uid-safe/node_modules/random-bytes/README.md
new file mode 100644
index 0000000..df5aacc
--- /dev/null
+++ b/node_modules/csrf/node_modules/uid-safe/node_modules/random-bytes/README.md
@@ -0,0 +1,77 @@
+# random-bytes
+
+[![NPM Version][npm-image]][npm-url]
+[![NPM Downloads][downloads-image]][downloads-url]
+[![Node.js Version][node-version-image]][node-version-url]
+[![Build Status][travis-image]][travis-url]
+[![Test Coverage][coveralls-image]][coveralls-url]
+
+Generate strong pseudo-random bytes.
+
+This module is a simple wrapper around the Node.js core `crypto.randomBytes` API,
+with the following additions:
+
+  * A `Promise` interface for environments with promises.
+  * For Node.js versions that do not wait for the PRNG to be seeded, this module
+    will wait a bit.
+
+## Installation
+
+```sh
+$ npm install random-bytes
+```
+
+## API
+
+```js
+var randomBytes = require('random-bytes')
+```
+
+### randomBytes(size, callback)
+
+Generates strong pseudo-random bytes. The `size` argument is a number indicating
+the number of bytes to generate.
+
+```js
+randomBytes(12, function (error, bytes) {
+  if (error) throw error
+  // do something with the bytes
+})
+```
+
+### randomBytes(size)
+
+Generates strong pseudo-random bytes and return a `Promise`. The `size` argument is
+a number indicating the number of bytes to generate.
+
+**Note**: To use promises in Node.js _prior to 0.12_, promises must be
+"polyfilled" using `global.Promise = require('bluebird')`.
+
+```js
+randomBytes(18).then(function (string) {
+  // do something with the string
+})
+```
+
+### randomBytes.sync(size)
+
+A synchronous version of above.
+
+```js
+var bytes = randomBytes.sync(18)
+```
+
+## License
+
+[MIT](LICENSE)
+
+[npm-image]: https://img.shields.io/npm/v/random-bytes.svg
+[npm-url]: https://npmjs.org/package/random-bytes
+[node-version-image]: https://img.shields.io/node/v/random-bytes.svg
+[node-version-url]: http://nodejs.org/download/
+[travis-image]: https://img.shields.io/travis/crypto-utils/random-bytes/master.svg
+[travis-url]: https://travis-ci.org/crypto-utils/random-bytes
+[coveralls-image]: https://img.shields.io/coveralls/crypto-utils/random-bytes/master.svg
+[coveralls-url]: https://coveralls.io/r/crypto-utils/random-bytes?branch=master
+[downloads-image]: https://img.shields.io/npm/dm/random-bytes.svg
+[downloads-url]: https://npmjs.org/package/random-bytes
diff --git a/node_modules/csrf/node_modules/uid-safe/node_modules/random-bytes/index.js b/node_modules/csrf/node_modules/uid-safe/node_modules/random-bytes/index.js
new file mode 100644
index 0000000..9ad930f
--- /dev/null
+++ b/node_modules/csrf/node_modules/uid-safe/node_modules/random-bytes/index.js
@@ -0,0 +1,101 @@
+/*!
+ * random-bytes
+ * Copyright(c) 2016 Douglas Christopher Wilson
+ * MIT Licensed
+ */
+
+'use strict'
+
+/**
+ * Module dependencies.
+ * @private
+ */
+
+var crypto = require('crypto')
+
+/**
+ * Module variables.
+ * @private
+ */
+
+var generateAttempts = crypto.randomBytes === crypto.pseudoRandomBytes ? 1 : 3
+
+/**
+ * Module exports.
+ * @public
+ */
+
+module.exports = randomBytes
+module.exports.sync = randomBytesSync
+
+/**
+ * Generates strong pseudo-random bytes.
+ *
+ * @param {number} size
+ * @param {function} [callback]
+ * @return {Promise}
+ * @public
+ */
+
+function randomBytes(size, callback) {
+  // validate callback is a function, if provided
+  if (callback !== undefined && typeof callback !== 'function') {
+    throw new TypeError('argument callback must be a function')
+  }
+
+  // require the callback without promises
+  if (!callback && !global.Promise) {
+    throw new TypeError('argument callback is required')
+  }
+
+  if (callback) {
+    // classic callback style
+    return generateRandomBytes(size, generateAttempts, callback)
+  }
+
+  return new Promise(function executor(resolve, reject) {
+    generateRandomBytes(size, generateAttempts, function onRandomBytes(err, str) {
+      if (err) return reject(err)
+      resolve(str)
+    })
+  })
+}
+
+/**
+ * Generates strong pseudo-random bytes sync.
+ *
+ * @param {number} size
+ * @return {Buffer}
+ * @public
+ */
+
+function randomBytesSync(size) {
+  var err = null
+
+  for (var i = 0; i < generateAttempts; i++) {
+    try {
+      return crypto.randomBytes(size)
+    } catch (e) {
+      err = e
+    }
+  }
+
+  throw err
+}
+
+/**
+ * Generates strong pseudo-random bytes.
+ *
+ * @param {number} size
+ * @param {number} attempts
+ * @param {function} callback
+ * @private
+ */
+
+function generateRandomBytes(size, attempts, callback) {
+  crypto.randomBytes(size, function onRandomBytes(err, buf) {
+    if (!err) return callback(null, buf)
+    if (!--attempts) return callback(err)
+    setTimeout(generateRandomBytes.bind(null, size, attempts, callback), 10)
+  })
+}
diff --git a/node_modules/csrf/node_modules/uid-safe/node_modules/random-bytes/package.json b/node_modules/csrf/node_modules/uid-safe/node_modules/random-bytes/package.json
new file mode 100644
index 0000000..8f56cba
--- /dev/null
+++ b/node_modules/csrf/node_modules/uid-safe/node_modules/random-bytes/package.json
@@ -0,0 +1,68 @@
+{
+  "name": "random-bytes",
+  "description": "URL and cookie safe UIDs",
+  "version": "1.0.0",
+  "contributors": [
+    {
+      "name": "Douglas Christopher Wilson",
+      "email": "doug@somethingdoug.com"
+    }
+  ],
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/crypto-utils/random-bytes.git"
+  },
+  "devDependencies": {
+    "bluebird": "3.1.1",
+    "istanbul": "0.4.2",
+    "mocha": "2.3.4",
+    "proxyquire": "1.2.0"
+  },
+  "files": [
+    "LICENSE",
+    "HISTORY.md",
+    "README.md",
+    "index.js"
+  ],
+  "engines": {
+    "node": ">= 0.8"
+  },
+  "scripts": {
+    "test": "mocha --trace-deprecation --reporter spec --bail --check-leaks test/",
+    "test-cov": "istanbul cover node_modules/mocha/bin/_mocha -- --trace-deprecation --reporter dot --check-leaks test/",
+    "test-travis": "istanbul cover node_modules/mocha/bin/_mocha --report lcovonly -- --trace-deprecation --reporter spec --check-leaks test/"
+  },
+  "keywords": [
+    "bytes",
+    "generator",
+    "random",
+    "safe"
+  ],
+  "gitHead": "3dcd47425a3dfe858ee8debcd4db0c1222110bc3",
+  "bugs": {
+    "url": "https://github.com/crypto-utils/random-bytes/issues"
+  },
+  "homepage": "https://github.com/crypto-utils/random-bytes",
+  "_id": "random-bytes@1.0.0",
+  "_shasum": "4f68a1dc0ae58bd3fb95848c30324db75d64360b",
+  "_from": "random-bytes@>=1.0.0 <1.1.0",
+  "_npmVersion": "1.4.28",
+  "_npmUser": {
+    "name": "dougwilson",
+    "email": "doug@somethingdoug.com"
+  },
+  "maintainers": [
+    {
+      "name": "dougwilson",
+      "email": "doug@somethingdoug.com"
+    }
+  ],
+  "dist": {
+    "shasum": "4f68a1dc0ae58bd3fb95848c30324db75d64360b",
+    "tarball": "https://registry.npmjs.org/random-bytes/-/random-bytes-1.0.0.tgz"
+  },
+  "directories": {},
+  "_resolved": "https://registry.npmjs.org/random-bytes/-/random-bytes-1.0.0.tgz",
+  "readme": "ERROR: No README data found!"
+}
diff --git a/node_modules/csrf/node_modules/uid-safe/package.json b/node_modules/csrf/node_modules/uid-safe/package.json
new file mode 100644
index 0000000..295b4a9
--- /dev/null
+++ b/node_modules/csrf/node_modules/uid-safe/package.json
@@ -0,0 +1,89 @@
+{
+  "name": "uid-safe",
+  "description": "URL and cookie safe UIDs",
+  "version": "2.1.1",
+  "contributors": [
+    {
+      "name": "Douglas Christopher Wilson",
+      "email": "doug@somethingdoug.com"
+    },
+    {
+      "name": "Jonathan Ong",
+      "email": "me@jongleberry.com",
+      "url": "http://jongleberry.com"
+    }
+  ],
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/crypto-utils/uid-safe.git"
+  },
+  "dependencies": {
+    "base64-url": "1.2.2",
+    "random-bytes": "~1.0.0"
+  },
+  "devDependencies": {
+    "bluebird": "3.3.5",
+    "istanbul": "0.4.3",
+    "mocha": "2.4.5"
+  },
+  "files": [
+    "LICENSE",
+    "HISTORY.md",
+    "README.md",
+    "index.js"
+  ],
+  "engines": {
+    "node": ">= 0.8"
+  },
+  "scripts": {
+    "test": "mocha --trace-deprecation --reporter spec --bail --check-leaks test/",
+    "test-cov": "istanbul cover node_modules/mocha/bin/_mocha -- --trace-deprecation --reporter dot --check-leaks test/",
+    "test-travis": "istanbul cover node_modules/mocha/bin/_mocha --report lcovonly -- --trace-deprecation --reporter spec --check-leaks test/"
+  },
+  "keywords": [
+    "random",
+    "generator",
+    "uid",
+    "safe"
+  ],
+  "gitHead": "5cb17ae9451505ac823877e641a6f080731822ea",
+  "bugs": {
+    "url": "https://github.com/crypto-utils/uid-safe/issues"
+  },
+  "homepage": "https://github.com/crypto-utils/uid-safe#readme",
+  "_id": "uid-safe@2.1.1",
+  "_shasum": "3dbf9436b528be9f52882c05a6216c3763db3666",
+  "_from": "uid-safe@2.1.1",
+  "_npmVersion": "2.15.1",
+  "_nodeVersion": "4.4.3",
+  "_npmUser": {
+    "name": "dougwilson",
+    "email": "doug@somethingdoug.com"
+  },
+  "dist": {
+    "shasum": "3dbf9436b528be9f52882c05a6216c3763db3666",
+    "tarball": "https://registry.npmjs.org/uid-safe/-/uid-safe-2.1.1.tgz"
+  },
+  "maintainers": [
+    {
+      "name": "dougwilson",
+      "email": "doug@somethingdoug.com"
+    },
+    {
+      "name": "fishrock123",
+      "email": "fishrock123@rocketmail.com"
+    },
+    {
+      "name": "jongleberry",
+      "email": "jonathanrichardong@gmail.com"
+    }
+  ],
+  "_npmOperationalInternal": {
+    "host": "packages-12-west.internal.npmjs.com",
+    "tmp": "tmp/uid-safe-2.1.1.tgz_1462417218771_0.08699076832272112"
+  },
+  "directories": {},
+  "_resolved": "https://registry.npmjs.org/uid-safe/-/uid-safe-2.1.1.tgz",
+  "readme": "ERROR: No README data found!"
+}
diff --git a/node_modules/csrf/package.json b/node_modules/csrf/package.json
new file mode 100644
index 0000000..ff25f57
--- /dev/null
+++ b/node_modules/csrf/package.json
@@ -0,0 +1,93 @@
+{
+  "name": "csrf",
+  "description": "primary logic behind csrf tokens",
+  "version": "3.0.3",
+  "author": {
+    "name": "Jonathan Ong",
+    "email": "me@jongleberry.com",
+    "url": "http://jongleberry.com"
+  },
+  "contributors": [
+    {
+      "name": "Douglas Christopher Wilson",
+      "email": "doug@somethingdoug.com"
+    }
+  ],
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/pillarjs/csrf.git"
+  },
+  "dependencies": {
+    "base64-url": "1.2.2",
+    "rndm": "1.2.0",
+    "tsscmp": "1.0.5",
+    "uid-safe": "2.1.1"
+  },
+  "devDependencies": {
+    "bluebird": "3.4.0",
+    "eslint": "2.10.2",
+    "eslint-config-standard": "5.3.1",
+    "eslint-plugin-promise": "1.3.0",
+    "eslint-plugin-standard": "1.3.2",
+    "istanbul": "0.4.3",
+    "mocha": "2.5.3"
+  },
+  "files": [
+    "LICENSE",
+    "HISTORY.md",
+    "README.md",
+    "index.js"
+  ],
+  "engines": {
+    "node": ">= 0.8"
+  },
+  "scripts": {
+    "lint": "eslint **/*.js",
+    "test": "mocha --trace-deprecation --reporter spec --bail --check-leaks test/",
+    "test-cov": "istanbul cover node_modules/mocha/bin/_mocha -- --trace-deprecation --reporter dot --check-leaks test/",
+    "test-travis": "istanbul cover node_modules/mocha/bin/_mocha --report lcovonly -- --trace-deprecation --reporter spec --check-leaks test/"
+  },
+  "keywords": [
+    "csrf",
+    "tokens"
+  ],
+  "gitHead": "dbf7629bbff7ae14dfa7fab1b439e01b5ba3b629",
+  "bugs": {
+    "url": "https://github.com/pillarjs/csrf/issues"
+  },
+  "homepage": "https://github.com/pillarjs/csrf",
+  "_id": "csrf@3.0.3",
+  "_shasum": "69d13220de95762808bb120f7533a994fc4293b5",
+  "_from": "csrf@latest",
+  "_npmVersion": "1.4.28",
+  "_npmUser": {
+    "name": "dougwilson",
+    "email": "doug@somethingdoug.com"
+  },
+  "maintainers": [
+    {
+      "name": "dougwilson",
+      "email": "doug@somethingdoug.com"
+    },
+    {
+      "name": "dwolla",
+      "email": "api@dwolla.com"
+    },
+    {
+      "name": "jongleberry",
+      "email": "jonathanrichardong@gmail.com"
+    }
+  ],
+  "dist": {
+    "shasum": "69d13220de95762808bb120f7533a994fc4293b5",
+    "tarball": "https://registry.npmjs.org/csrf/-/csrf-3.0.3.tgz"
+  },
+  "_npmOperationalInternal": {
+    "host": "packages-12-west.internal.npmjs.com",
+    "tmp": "tmp/csrf-3.0.3.tgz_1464315403837_0.44625049154274166"
+  },
+  "directories": {},
+  "_resolved": "https://registry.npmjs.org/csrf/-/csrf-3.0.3.tgz",
+  "readme": "ERROR: No README data found!"
+}