Fixed admin bug

32 files changed, 2094 insertions, 1 deletions

diff --git a/node_modules/csurf/node_modules/cookie-signature/.npmignore b/node_modules/csurf/node_modules/cookie-signature/.npmignore
new file mode 100644
index 0000000..f1250e5
--- /dev/null
+++ b/node_modules/csurf/node_modules/cookie-signature/.npmignore
@@ -0,0 +1,4 @@
+support
+test
+examples
+*.sock
diff --git a/node_modules/csurf/node_modules/cookie-signature/History.md b/node_modules/csurf/node_modules/cookie-signature/History.md
new file mode 100644
index 0000000..78513cc
--- /dev/null
+++ b/node_modules/csurf/node_modules/cookie-signature/History.md
@@ -0,0 +1,38 @@
+1.0.6 / 2015-02-03
+==================
+
+* use `npm test` instead of `make test` to run tests
+* clearer assertion messages when checking input
+
+
+1.0.5 / 2014-09-05
+==================
+
+* add license to package.json
+
+1.0.4 / 2014-06-25
+==================
+
+ * corrected avoidance of timing attacks (thanks @tenbits!)
+
+1.0.3 / 2014-01-28
+==================
+
+ * [incorrect] fix for timing attacks
+
+1.0.2 / 2014-01-28
+==================
+
+ * fix missing repository warning
+ * fix typo in test
+
+1.0.1 / 2013-04-15
+==================
+
+  * Revert "Changed underlying HMAC algo. to sha512."
+  * Revert "Fix for timing attacks on MAC verification."
+
+0.0.1 / 2010-01-03
+==================
+
+  * Initial release
diff --git a/node_modules/csurf/node_modules/cookie-signature/Readme.md b/node_modules/csurf/node_modules/cookie-signature/Readme.md
new file mode 100644
index 0000000..2559e84
--- /dev/null
+++ b/node_modules/csurf/node_modules/cookie-signature/Readme.md
@@ -0,0 +1,42 @@
+
+# cookie-signature
+
+  Sign and unsign cookies.
+
+## Example
+
+```js
+var cookie = require('cookie-signature');
+
+var val = cookie.sign('hello', 'tobiiscool');
+val.should.equal('hello.DGDUkGlIkCzPz+C0B064FNgHdEjox7ch8tOBGslZ5QI');
+
+var val = cookie.sign('hello', 'tobiiscool');
+cookie.unsign(val, 'tobiiscool').should.equal('hello');
+cookie.unsign(val, 'luna').should.be.false;
+```
+
+## License 
+
+(The MIT License)
+
+Copyright (c) 2012 LearnBoost <tj@learnboost.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
\ No newline at end of file
diff --git a/node_modules/csurf/node_modules/cookie-signature/index.js b/node_modules/csurf/node_modules/cookie-signature/index.js
new file mode 100644
index 0000000..b8c9463
--- /dev/null
+++ b/node_modules/csurf/node_modules/cookie-signature/index.js
@@ -0,0 +1,51 @@
+/**
+ * Module dependencies.
+ */
+
+var crypto = require('crypto');
+
+/**
+ * Sign the given `val` with `secret`.
+ *
+ * @param {String} val
+ * @param {String} secret
+ * @return {String}
+ * @api private
+ */
+
+exports.sign = function(val, secret){
+  if ('string' != typeof val) throw new TypeError("Cookie value must be provided as a string.");
+  if ('string' != typeof secret) throw new TypeError("Secret string must be provided.");
+  return val + '.' + crypto
+    .createHmac('sha256', secret)
+    .update(val)
+    .digest('base64')
+    .replace(/\=+$/, '');
+};
+
+/**
+ * Unsign and decode the given `val` with `secret`,
+ * returning `false` if the signature is invalid.
+ *
+ * @param {String} val
+ * @param {String} secret
+ * @return {String|Boolean}
+ * @api private
+ */
+
+exports.unsign = function(val, secret){
+  if ('string' != typeof val) throw new TypeError("Signed cookie string must be provided.");
+  if ('string' != typeof secret) throw new TypeError("Secret string must be provided.");
+  var str = val.slice(0, val.lastIndexOf('.'))
+    , mac = exports.sign(str, secret);
+  
+  return sha1(mac) == sha1(val) ? str : false;
+};
+
+/**
+ * Private
+ */
+
+function sha1(str){
+  return crypto.createHash('sha1').update(str).digest('hex');
+}
diff --git a/node_modules/csurf/node_modules/cookie-signature/package.json b/node_modules/csurf/node_modules/cookie-signature/package.json
new file mode 100644
index 0000000..f564ea5
--- /dev/null
+++ b/node_modules/csurf/node_modules/cookie-signature/package.json
@@ -0,0 +1,59 @@
+{
+  "name": "cookie-signature",
+  "version": "1.0.6",
+  "description": "Sign and unsign cookies",
+  "keywords": [
+    "cookie",
+    "sign",
+    "unsign"
+  ],
+  "author": {
+    "name": "TJ Holowaychuk",
+    "email": "tj@learnboost.com"
+  },
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/visionmedia/node-cookie-signature.git"
+  },
+  "dependencies": {},
+  "devDependencies": {
+    "mocha": "*",
+    "should": "*"
+  },
+  "scripts": {
+    "test": "mocha --require should --reporter spec"
+  },
+  "main": "index",
+  "gitHead": "391b56cf44d88c493491b7e3fc53208cfb976d2a",
+  "bugs": {
+    "url": "https://github.com/visionmedia/node-cookie-signature/issues"
+  },
+  "homepage": "https://github.com/visionmedia/node-cookie-signature",
+  "_id": "cookie-signature@1.0.6",
+  "_shasum": "e303a882b342cc3ee8ca513a79999734dab3ae2c",
+  "_from": "cookie-signature@1.0.6",
+  "_npmVersion": "2.3.0",
+  "_nodeVersion": "0.10.36",
+  "_npmUser": {
+    "name": "natevw",
+    "email": "natevw@yahoo.com"
+  },
+  "maintainers": [
+    {
+      "name": "tjholowaychuk",
+      "email": "tj@vision-media.ca"
+    },
+    {
+      "name": "natevw",
+      "email": "natevw@yahoo.com"
+    }
+  ],
+  "dist": {
+    "shasum": "e303a882b342cc3ee8ca513a79999734dab3ae2c",
+    "tarball": "https://registry.npmjs.org/cookie-signature/-/cookie-signature-1.0.6.tgz"
+  },
+  "directories": {},
+  "_resolved": "https://registry.npmjs.org/cookie-signature/-/cookie-signature-1.0.6.tgz",
+  "readme": "ERROR: No README data found!"
+}
diff --git a/node_modules/csurf/node_modules/cookie/HISTORY.md b/node_modules/csurf/node_modules/cookie/HISTORY.md
new file mode 100644
index 0000000..5bd6485
--- /dev/null
+++ b/node_modules/csurf/node_modules/cookie/HISTORY.md
@@ -0,0 +1,118 @@
+0.3.1 / 2016-05-26
+==================
+
+  * Fix `sameSite: true` to work with draft-7 clients
+    - `true` now sends `SameSite=Strict` instead of `SameSite`
+
+0.3.0 / 2016-05-26
+==================
+
+  * Add `sameSite` option
+    - Replaces `firstPartyOnly` option, never implemented by browsers
+  * Improve error message when `encode` is not a function
+  * Improve error message when `expires` is not a `Date`
+
+0.2.4 / 2016-05-20
+==================
+
+  * perf: enable strict mode
+  * perf: use for loop in parse
+  * perf: use string concatination for serialization
+
+0.2.3 / 2015-10-25
+==================
+
+  * Fix cookie `Max-Age` to never be a floating point number
+
+0.2.2 / 2015-09-17
+==================
+
+  * Fix regression when setting empty cookie value
+    - Ease the new restriction, which is just basic header-level validation
+  * Fix typo in invalid value errors
+
+0.2.1 / 2015-09-17
+==================
+
+  * Throw on invalid values provided to `serialize`
+    - Ensures the resulting string is a valid HTTP header value
+
+0.2.0 / 2015-08-13
+==================
+
+  * Add `firstPartyOnly` option
+  * Throw better error for invalid argument to parse
+  * perf: hoist regular expression
+
+0.1.5 / 2015-09-17
+==================
+
+  * Fix regression when setting empty cookie value
+    - Ease the new restriction, which is just basic header-level validation
+  * Fix typo in invalid value errors
+
+0.1.4 / 2015-09-17
+==================
+
+  * Throw better error for invalid argument to parse
+  * Throw on invalid values provided to `serialize`
+    - Ensures the resulting string is a valid HTTP header value
+
+0.1.3 / 2015-05-19
+==================
+
+  * Reduce the scope of try-catch deopt
+  * Remove argument reassignments
+
+0.1.2 / 2014-04-16
+==================
+
+  * Remove unnecessary files from npm package
+
+0.1.1 / 2014-02-23
+==================
+
+  * Fix bad parse when cookie value contained a comma
+  * Fix support for `maxAge` of `0`
+
+0.1.0 / 2013-05-01
+==================
+
+  * Add `decode` option
+  * Add `encode` option
+
+0.0.6 / 2013-04-08
+==================
+
+  * Ignore cookie parts missing `=`
+
+0.0.5 / 2012-10-29
+==================
+
+  * Return raw cookie value if value unescape errors
+
+0.0.4 / 2012-06-21
+==================
+
+  * Use encode/decodeURIComponent for cookie encoding/decoding
+    - Improve server/client interoperability
+
+0.0.3 / 2012-06-06
+==================
+
+  * Only escape special characters per the cookie RFC
+
+0.0.2 / 2012-06-01
+==================
+
+  * Fix `maxAge` option to not throw error
+
+0.0.1 / 2012-05-28
+==================
+
+  * Add more tests
+
+0.0.0 / 2012-05-28
+==================
+
+  * Initial release
diff --git a/node_modules/csurf/node_modules/cookie/LICENSE b/node_modules/csurf/node_modules/cookie/LICENSE
new file mode 100644
index 0000000..058b6b4
--- /dev/null
+++ b/node_modules/csurf/node_modules/cookie/LICENSE
@@ -0,0 +1,24 @@
+(The MIT License)
+
+Copyright (c) 2012-2014 Roman Shtylman <shtylman@gmail.com>
+Copyright (c) 2015 Douglas Christopher Wilson <doug@somethingdoug.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
diff --git a/node_modules/csurf/node_modules/cookie/README.md b/node_modules/csurf/node_modules/cookie/README.md
new file mode 100644
index 0000000..db0d078
--- /dev/null
+++ b/node_modules/csurf/node_modules/cookie/README.md
@@ -0,0 +1,220 @@
+# cookie
+
+[![NPM Version][npm-image]][npm-url]
+[![NPM Downloads][downloads-image]][downloads-url]
+[![Node.js Version][node-version-image]][node-version-url]
+[![Build Status][travis-image]][travis-url]
+[![Test Coverage][coveralls-image]][coveralls-url]
+
+Basic HTTP cookie parser and serializer for HTTP servers.
+
+## Installation
+
+```sh
+$ npm install cookie
+```
+
+## API
+
+```js
+var cookie = require('cookie');
+```
+
+### cookie.parse(str, options)
+
+Parse an HTTP `Cookie` header string and returning an object of all cookie name-value pairs.
+The `str` argument is the string representing a `Cookie` header value and `options` is an
+optional object containing additional parsing options.
+
+```js
+var cookies = cookie.parse('foo=bar; equation=E%3Dmc%5E2');
+// { foo: 'bar', equation: 'E=mc^2' }
+```
+
+#### Options
+
+`cookie.parse` accepts these properties in the options object.
+
+##### decode
+
+Specifies a function that will be used to decode a cookie's value. Since the value of a cookie
+has a limited character set (and must be a simple string), this function can be used to decode
+a previously-encoded cookie value into a JavaScript string or other object.
+
+The default function is the global `decodeURIComponent`, which will decode any URL-encoded
+sequences into their byte representations.
+
+**note** if an error is thrown from this function, the original, non-decoded cookie value will
+be returned as the cookie's value.
+
+### cookie.serialize(name, value, options)
+
+Serialize a cookie name-value pair into a `Set-Cookie` header string. The `name` argument is the
+name for the cookie, the `value` argument is the value to set the cookie to, and the `options`
+argument is an optional object containing additional serialization options.
+
+```js
+var setCookie = cookie.serialize('foo', 'bar');
+// foo=bar
+```
+
+#### Options
+
+`cookie.serialize` accepts these properties in the options object.
+
+##### domain
+
+Specifies the value for the [`Domain` `Set-Cookie` attribute][rfc-6266-5.2.3]. By default, no
+domain is set, and most clients will consider the cookie to apply to only the current domain.
+
+##### encode
+
+Specifies a function that will be used to encode a cookie's value. Since value of a cookie
+has a limited character set (and must be a simple string), this function can be used to encode
+a value into a string suited for a cookie's value.
+
+The default function is the global `ecodeURIComponent`, which will encode a JavaScript string
+into UTF-8 byte sequences and then URL-encode any that fall outside of the cookie range.
+
+##### expires
+
+Specifies the `Date` object to be the value for the [`Expires` `Set-Cookie` attribute][rfc-6266-5.2.1].
+By default, no expiration is set, and most clients will consider this a "non-persistent cookie" and
+will delete it on a condition like exiting a web browser application.
+
+**note** the [cookie storage model specification][rfc-6266-5.3] states that if both `expires` and
+`magAge` are set, then `maxAge` takes precedence, but it is possiblke not all clients by obey this,
+so if both are set, they should point to the same date and time.
+
+##### httpOnly
+
+Specifies the `boolean` value for the [`HttpOnly` `Set-Cookie` attribute][rfc-6266-5.2.6]. When truthy,
+the `HttpOnly` attribute is set, otherwise it is not. By default, the `HttpOnly` attribute is not set.
+
+**note** be careful when setting this to `true`, as compliant clients will not allow client-side
+JavaScript to see the cookie in `document.cookie`.
+
+##### maxAge
+
+Specifies the `number` (in seconds) to be the value for the [`Max-Age` `Set-Cookie` attribute][rfc-6266-5.2.2].
+The given number will be converted to an integer by rounding down. By default, no maximum age is set.
+
+**note** the [cookie storage model specification][rfc-6266-5.3] states that if both `expires` and
+`magAge` are set, then `maxAge` takes precedence, but it is possiblke not all clients by obey this,
+so if both are set, they should point to the same date and time.
+
+##### path
+
+Specifies the value for the [`Path` `Set-Cookie` attribute][rfc-6266-5.2.4]. By default, the path
+is considered the ["default path"][rfc-6266-5.1.4]. By default, no maximum age is set, and most
+clients will consider this a "non-persistent cookie" and will delete it on a condition like exiting
+a web browser application.
+
+##### sameSite
+
+Specifies the `boolean` or `string` to be the value for the [`SameSite` `Set-Cookie` attribute][draft-west-first-party-cookies-07].
+
+  - `true` will set the `SameSite` attribute to `Strict` for strict same site enforcement.
+  - `false` will not set the `SameSite` attribute.
+  - `'lax'` will set the `SameSite` attribute to `Lax` for lax same site enforcement.
+  - `'strict'` will set the `SameSite` attribute to `Strict` for strict same site enforcement.
+
+More information about the different enforcement levels can be found in the specification
+https://tools.ietf.org/html/draft-west-first-party-cookies-07#section-4.1.1
+
+**note** This is an attribute that has not yet been fully standardized, and may change in the future.
+This also means many clients may ignore this attribute until they understand it.
+
+##### secure
+
+Specifies the `boolean` value for the [`Secure` `Set-Cookie` attribute][rfc-6266-5.2.5]. When truthy,
+the `Secure` attribute is set, otherwise it is not. By default, the `Secure` attribute is not set.
+
+**note** be careful when setting this to `true`, as compliant clients will not send the cookie back to
+the server in the future if the browser does not have an HTTPS connection.
+
+## Example
+
+The following example uses this module in conjunction with the Node.js core HTTP server
+to prompt a user for their name and display it back on future visits.
+
+```js
+var cookie = require('cookie');
+var escapeHtml = require('escape-html');
+var http = require('http');
+var url = require('url');
+
+function onRequest(req, res) {
+  // Parse the query string
+  var query = url.parse(req.url, true, true).query;
+
+  if (query && query.name) {
+    // Set a new cookie with the name
+    res.setHeader('Set-Cookie', cookie.serialize('name', String(query.name), {
+      httpOnly: true,
+      maxAge: 60 * 60 * 24 * 7 // 1 week
+    }));
+
+    // Redirect back after setting cookie
+    res.statusCode = 302;
+    res.setHeader('Location', req.headers.referer || '/');
+    res.end();
+    return;
+  }
+
+  // Parse the cookies on the request
+  var cookies = cookie.parse(req.headers.cookie || '');
+
+  // Get the visitor name set in the cookie
+  var name = cookies.name;
+
+  res.setHeader('Content-Type', 'text/html; charset=UTF-8');
+
+  if (name) {
+    res.write('<p>Welcome back, <b>' + escapeHtml(name) + '</b>!</p>');
+  } else {
+    res.write('<p>Hello, new visitor!</p>');
+  }
+
+  res.write('<form method="GET">');
+  res.write('<input placeholder="enter your name" name="name"> <input type="submit" value="Set Name">');
+  res.end('</form');
+}
+
+http.createServer(onRequest).listen(3000);
+```
+
+## Testing
+
+```sh
+$ npm test
+```
+
+## References
+
+- [RFC 6266: HTTP State Management Mechanism][rfc-6266]
+- [Same-site Cookies][draft-west-first-party-cookies-07]
+
+[draft-west-first-party-cookies-07]: https://tools.ietf.org/html/draft-west-first-party-cookies-07
+[rfc-6266]: https://tools.ietf.org/html/rfc6266
+[rfc-6266-5.1.4]: https://tools.ietf.org/html/rfc6266#section-5.1.4
+[rfc-6266-5.2.1]: https://tools.ietf.org/html/rfc6266#section-5.2.1
+[rfc-6266-5.2.2]: https://tools.ietf.org/html/rfc6266#section-5.2.2
+[rfc-6266-5.2.3]: https://tools.ietf.org/html/rfc6266#section-5.2.3
+[rfc-6266-5.2.4]: https://tools.ietf.org/html/rfc6266#section-5.2.4
+[rfc-6266-5.3]: https://tools.ietf.org/html/rfc6266#section-5.3
+
+## License
+
+[MIT](LICENSE)
+
+[npm-image]: https://img.shields.io/npm/v/cookie.svg
+[npm-url]: https://npmjs.org/package/cookie
+[node-version-image]: https://img.shields.io/node/v/cookie.svg
+[node-version-url]: https://nodejs.org/en/download
+[travis-image]: https://img.shields.io/travis/jshttp/cookie/master.svg
+[travis-url]: https://travis-ci.org/jshttp/cookie
+[coveralls-image]: https://img.shields.io/coveralls/jshttp/cookie/master.svg
+[coveralls-url]: https://coveralls.io/r/jshttp/cookie?branch=master
+[downloads-image]: https://img.shields.io/npm/dm/cookie.svg
+[downloads-url]: https://npmjs.org/package/cookie
diff --git a/node_modules/csurf/node_modules/cookie/index.js b/node_modules/csurf/node_modules/cookie/index.js
new file mode 100644
index 0000000..ab2e467
--- /dev/null
+++ b/node_modules/csurf/node_modules/cookie/index.js
@@ -0,0 +1,195 @@
+/*!
+ * cookie
+ * Copyright(c) 2012-2014 Roman Shtylman
+ * Copyright(c) 2015 Douglas Christopher Wilson
+ * MIT Licensed
+ */
+
+'use strict';
+
+/**
+ * Module exports.
+ * @public
+ */
+
+exports.parse = parse;
+exports.serialize = serialize;
+
+/**
+ * Module variables.
+ * @private
+ */
+
+var decode = decodeURIComponent;
+var encode = encodeURIComponent;
+var pairSplitRegExp = /; */;
+
+/**
+ * RegExp to match field-content in RFC 7230 sec 3.2
+ *
+ * field-content = field-vchar [ 1*( SP / HTAB ) field-vchar ]
+ * field-vchar   = VCHAR / obs-text
+ * obs-text      = %x80-FF
+ */
+
+var fieldContentRegExp = /^[\u0009\u0020-\u007e\u0080-\u00ff]+$/;
+
+/**
+ * Parse a cookie header.
+ *
+ * Parse the given cookie header string into an object
+ * The object has the various cookies as keys(names) => values
+ *
+ * @param {string} str
+ * @param {object} [options]
+ * @return {object}
+ * @public
+ */
+
+function parse(str, options) {
+  if (typeof str !== 'string') {
+    throw new TypeError('argument str must be a string');
+  }
+
+  var obj = {}
+  var opt = options || {};
+  var pairs = str.split(pairSplitRegExp);
+  var dec = opt.decode || decode;
+
+  for (var i = 0; i < pairs.length; i++) {
+    var pair = pairs[i];
+    var eq_idx = pair.indexOf('=');
+
+    // skip things that don't look like key=value
+    if (eq_idx < 0) {
+      continue;
+    }
+
+    var key = pair.substr(0, eq_idx).trim()
+    var val = pair.substr(++eq_idx, pair.length).trim();
+
+    // quoted values
+    if ('"' == val[0]) {
+      val = val.slice(1, -1);
+    }
+
+    // only assign once
+    if (undefined == obj[key]) {
+      obj[key] = tryDecode(val, dec);
+    }
+  }
+
+  return obj;
+}
+
+/**
+ * Serialize data into a cookie header.
+ *
+ * Serialize the a name value pair into a cookie string suitable for
+ * http headers. An optional options object specified cookie parameters.
+ *
+ * serialize('foo', 'bar', { httpOnly: true })
+ *   => "foo=bar; httpOnly"
+ *
+ * @param {string} name
+ * @param {string} val
+ * @param {object} [options]
+ * @return {string}
+ * @public
+ */
+
+function serialize(name, val, options) {
+  var opt = options || {};
+  var enc = opt.encode || encode;
+
+  if (typeof enc !== 'function') {
+    throw new TypeError('option encode is invalid');
+  }
+
+  if (!fieldContentRegExp.test(name)) {
+    throw new TypeError('argument name is invalid');
+  }
+
+  var value = enc(val);
+
+  if (value && !fieldContentRegExp.test(value)) {
+    throw new TypeError('argument val is invalid');
+  }
+
+  var str = name + '=' + value;
+
+  if (null != opt.maxAge) {
+    var maxAge = opt.maxAge - 0;
+    if (isNaN(maxAge)) throw new Error('maxAge should be a Number');
+    str += '; Max-Age=' + Math.floor(maxAge);
+  }
+
+  if (opt.domain) {
+    if (!fieldContentRegExp.test(opt.domain)) {
+      throw new TypeError('option domain is invalid');
+    }
+
+    str += '; Domain=' + opt.domain;
+  }
+
+  if (opt.path) {
+    if (!fieldContentRegExp.test(opt.path)) {
+      throw new TypeError('option path is invalid');
+    }
+
+    str += '; Path=' + opt.path;
+  }
+
+  if (opt.expires) {
+    if (typeof opt.expires.toUTCString !== 'function') {
+      throw new TypeError('option expires is invalid');
+    }
+
+    str += '; Expires=' + opt.expires.toUTCString();
+  }
+
+  if (opt.httpOnly) {
+    str += '; HttpOnly';
+  }
+
+  if (opt.secure) {
+    str += '; Secure';
+  }
+
+  if (opt.sameSite) {
+    var sameSite = typeof opt.sameSite === 'string'
+      ? opt.sameSite.toLowerCase() : opt.sameSite;
+
+    switch (sameSite) {
+      case true:
+        str += '; SameSite=Strict';
+        break;
+      case 'lax':
+        str += '; SameSite=Lax';
+        break;
+      case 'strict':
+        str += '; SameSite=Strict';
+        break;
+      default:
+        throw new TypeError('option sameSite is invalid');
+    }
+  }
+
+  return str;
+}
+
+/**
+ * Try decoding a string using a decoding function.
+ *
+ * @param {string} str
+ * @param {function} decode
+ * @private
+ */
+
+function tryDecode(str, decode) {
+  try {
+    return decode(str);
+  } catch (e) {
+    return str;
+  }
+}
diff --git a/node_modules/csurf/node_modules/cookie/package.json b/node_modules/csurf/node_modules/cookie/package.json
new file mode 100644
index 0000000..bb3556a
--- /dev/null
+++ b/node_modules/csurf/node_modules/cookie/package.json
@@ -0,0 +1,72 @@
+{
+  "name": "cookie",
+  "description": "HTTP server cookie parsing and serialization",
+  "version": "0.3.1",
+  "author": {
+    "name": "Roman Shtylman",
+    "email": "shtylman@gmail.com"
+  },
+  "contributors": [
+    {
+      "name": "Douglas Christopher Wilson",
+      "email": "doug@somethingdoug.com"
+    }
+  ],
+  "license": "MIT",
+  "keywords": [
+    "cookie",
+    "cookies"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/jshttp/cookie.git"
+  },
+  "devDependencies": {
+    "istanbul": "0.4.3",
+    "mocha": "1.21.5"
+  },
+  "files": [
+    "HISTORY.md",
+    "LICENSE",
+    "README.md",
+    "index.js"
+  ],
+  "engines": {
+    "node": ">= 0.6"
+  },
+  "scripts": {
+    "test": "mocha --reporter spec --bail --check-leaks test/",
+    "test-ci": "istanbul cover node_modules/mocha/bin/_mocha --report lcovonly -- --reporter spec --check-leaks test/",
+    "test-cov": "istanbul cover node_modules/mocha/bin/_mocha -- --reporter dot --check-leaks test/"
+  },
+  "gitHead": "e3c77d497d66c8b8d4b677b8954c1b192a09f0b3",
+  "bugs": {
+    "url": "https://github.com/jshttp/cookie/issues"
+  },
+  "homepage": "https://github.com/jshttp/cookie",
+  "_id": "cookie@0.3.1",
+  "_shasum": "e7e0a1f9ef43b4c8ba925c5c5a96e806d16873bb",
+  "_from": "cookie@0.3.1",
+  "_npmVersion": "1.4.28",
+  "_npmUser": {
+    "name": "dougwilson",
+    "email": "doug@somethingdoug.com"
+  },
+  "maintainers": [
+    {
+      "name": "dougwilson",
+      "email": "doug@somethingdoug.com"
+    }
+  ],
+  "dist": {
+    "shasum": "e7e0a1f9ef43b4c8ba925c5c5a96e806d16873bb",
+    "tarball": "https://registry.npmjs.org/cookie/-/cookie-0.3.1.tgz"
+  },
+  "_npmOperationalInternal": {
+    "host": "packages-12-west.internal.npmjs.com",
+    "tmp": "tmp/cookie-0.3.1.tgz_1464323556714_0.6435900838114321"
+  },
+  "directories": {},
+  "_resolved": "https://registry.npmjs.org/cookie/-/cookie-0.3.1.tgz",
+  "readme": "ERROR: No README data found!"
+}
diff --git a/node_modules/csurf/node_modules/http-errors/HISTORY.md b/node_modules/csurf/node_modules/http-errors/HISTORY.md
new file mode 100644
index 0000000..0dfb7ac
--- /dev/null
+++ b/node_modules/csurf/node_modules/http-errors/HISTORY.md
@@ -0,0 +1,95 @@
+2016-05-18 / 1.5.0
+==================
+
+  * Support new code `421 Misdirected Request`
+  * Use `setprototypeof` module to replace `__proto__` setting
+  * deps: statuses@'>= 1.3.0 < 2'
+    - Add `421 Misdirected Request`
+    - perf: enable strict mode
+  * perf: enable strict mode
+
+2016-01-28 / 1.4.0
+==================
+
+  * Add `HttpError` export, for `err instanceof createError.HttpError`
+  * deps: inherits@2.0.1
+  * deps: statuses@'>= 1.2.1 < 2'
+    - Fix message for status 451
+    - Remove incorrect nginx status code
+
+2015-02-02 / 1.3.1
+==================
+
+  * Fix regression where status can be overwritten in `createError` `props`
+
+2015-02-01 / 1.3.0
+==================
+
+  * Construct errors using defined constructors from `createError`
+  * Fix error names that are not identifiers
+    - `createError["I'mateapot"]` is now `createError.ImATeapot`
+  * Set a meaningful `name` property on constructed errors
+
+2014-12-09 / 1.2.8
+==================
+
+  * Fix stack trace from exported function
+  * Remove `arguments.callee` usage
+
+2014-10-14 / 1.2.7
+==================
+
+  * Remove duplicate line
+
+2014-10-02 / 1.2.6
+==================
+
+  * Fix `expose` to be `true` for `ClientError` constructor
+
+2014-09-28 / 1.2.5
+==================
+
+  * deps: statuses@1
+
+2014-09-21 / 1.2.4
+==================
+
+  * Fix dependency version to work with old `npm`s
+
+2014-09-21 / 1.2.3
+==================
+
+  * deps: statuses@~1.1.0
+
+2014-09-21 / 1.2.2
+==================
+
+  * Fix publish error
+
+2014-09-21 / 1.2.1
+==================
+
+  * Support Node.js 0.6
+  * Use `inherits` instead of `util`
+
+2014-09-09 / 1.2.0
+==================
+
+  * Fix the way inheriting functions
+  * Support `expose` being provided in properties argument
+
+2014-09-08 / 1.1.0
+==================
+
+  * Default status to 500
+  * Support provided `error` to extend
+
+2014-09-08 / 1.0.1
+==================
+
+  * Fix accepting string message
+
+2014-09-08 / 1.0.0
+==================
+
+  * Initial release
diff --git a/node_modules/csurf/node_modules/http-errors/LICENSE b/node_modules/csurf/node_modules/http-errors/LICENSE
new file mode 100644
index 0000000..82af4df
--- /dev/null
+++ b/node_modules/csurf/node_modules/http-errors/LICENSE
@@ -0,0 +1,23 @@
+
+The MIT License (MIT)
+
+Copyright (c) 2014 Jonathan Ong me@jongleberry.com
+Copyright (c) 2016 Douglas Christopher Wilson doug@somethingdoug.com
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
diff --git a/node_modules/csurf/node_modules/http-errors/README.md b/node_modules/csurf/node_modules/http-errors/README.md
new file mode 100644
index 0000000..be80f9b
--- /dev/null
+++ b/node_modules/csurf/node_modules/http-errors/README.md
@@ -0,0 +1,112 @@
+# http-errors
+
+[![NPM Version][npm-image]][npm-url]
+[![NPM Downloads][downloads-image]][downloads-url]
+[![Node.js Version][node-version-image]][node-version-url]
+[![Build Status][travis-image]][travis-url]
+[![Test Coverage][coveralls-image]][coveralls-url]
+
+Create HTTP errors for Express, Koa, Connect, etc. with ease.
+
+## Example
+
+```js
+var createError = require('http-errors');
+
+app.use(function (req, res, next) {
+  if (!req.user) return next(createError(401, 'Please login to view this page.'));
+  next();
+})
+```
+
+## API
+
+This is the current API, currently extracted from Koa and subject to change.
+
+All errors inherit from JavaScript `Error` and the exported `createError.HttpError`.
+
+### Error Properties
+
+- `expose` - can be used to signal if `message` should be sent to the client, defaulting to `false` when `status` >= 500
+- `message`
+- `status` and `statusCode` - the status code of the error, defaulting to `500`
+
+### createError([status], [message], [properties])
+
+```js
+var err = createError(404, 'This video does not exist!');
+```
+
+- `status: 500` - the status code as a number
+- `message` - the message of the error, defaulting to node's text for that status code.
+- `properties` - custom properties to attach to the object
+
+### new createError\[code || name\](\[msg]\))
+
+```js
+var err = new createError.NotFound();
+```
+
+- `code` - the status code as a number
+- `name` - the name of the error as a "bumpy case", i.e. `NotFound` or `InternalServerError`.
+
+#### List of all constructors
+
+|Status Code|Constructor Name             |
+|-----------|-----------------------------|
+|400        |BadRequest                   |
+|401        |Unauthorized                 |
+|402        |PaymentRequired              |
+|403        |Forbidden                    |
+|404        |NotFound                     |
+|405        |MethodNotAllowed             |
+|406        |NotAcceptable                |
+|407        |ProxyAuthenticationRequired  |
+|408        |RequestTimeout               |
+|409        |Conflict                     |
+|410        |Gone                         |
+|411        |LengthRequired               |
+|412        |PreconditionFailed           |
+|413        |PayloadTooLarge              |
+|414        |URITooLong                   |
+|415        |UnsupportedMediaType         |
+|416        |RangeNotSatisfiable          |
+|417        |ExpectationFailed            |
+|418        |ImATeapot                    |
+|421        |MisdirectedRequest           |
+|422        |UnprocessableEntity          |
+|423        |Locked                       |
+|424        |FailedDependency             |
+|425        |UnorderedCollection          |
+|426        |UpgradeRequired              |
+|428        |PreconditionRequired         |
+|429        |TooManyRequests              |
+|431        |RequestHeaderFieldsTooLarge  |
+|451        |UnavailableForLegalReasons   |
+|500        |InternalServerError          |
+|501        |NotImplemented               |
+|502        |BadGateway                   |
+|503        |ServiceUnavailable           |
+|504        |GatewayTimeout               |
+|505        |HTTPVersionNotSupported      |
+|506        |VariantAlsoNegotiates        |
+|507        |InsufficientStorage          |
+|508        |LoopDetected                 |
+|509        |BandwidthLimitExceeded       |
+|510        |NotExtended                  |
+|511        |NetworkAuthenticationRequired|
+
+## License
+
+[MIT](LICENSE)
+
+[npm-image]: https://img.shields.io/npm/v/http-errors.svg?style=flat
+[npm-url]: https://npmjs.org/package/http-errors
+[node-version-image]: https://img.shields.io/node/v/http-errors.svg?style=flat
+[node-version-url]: https://nodejs.org/en/download/
+[travis-image]: https://img.shields.io/travis/jshttp/http-errors.svg?style=flat
+[travis-url]: https://travis-ci.org/jshttp/http-errors
+[coveralls-image]: https://img.shields.io/coveralls/jshttp/http-errors.svg?style=flat
+[coveralls-url]: https://coveralls.io/r/jshttp/http-errors
+[downloads-image]: https://img.shields.io/npm/dm/http-errors.svg?style=flat
+[downloads-url]: https://npmjs.org/package/http-errors
diff --git a/node_modules/csurf/node_modules/http-errors/index.js b/node_modules/csurf/node_modules/http-errors/index.js
new file mode 100644
index 0000000..6130db8
--- /dev/null
+++ b/node_modules/csurf/node_modules/http-errors/index.js
@@ -0,0 +1,223 @@
+/*!
+ * http-errors
+ * Copyright(c) 2014 Jonathan Ong
+ * Copyright(c) 2016 Douglas Christopher Wilson
+ * MIT Licensed
+ */
+
+'use strict'
+
+/**
+ * Module dependencies.
+ * @private
+ */
+
+var setPrototypeOf = require('setprototypeof')
+var statuses = require('statuses')
+var inherits = require('inherits')
+
+/**
+ * Module exports.
+ * @public
+ */
+
+module.exports = createError
+module.exports.HttpError = createHttpErrorConstructor()
+
+// Populate exports for all constructors
+populateConstructorExports(module.exports, statuses.codes, module.exports.HttpError)
+
+/**
+ * Create a new HTTP Error.
+ *
+ * @returns {Error}
+ * @public
+ */
+
+function createError () {
+  // so much arity going on ~_~
+  var err
+  var msg
+  var status = 500
+  var props = {}
+  for (var i = 0; i < arguments.length; i++) {
+    var arg = arguments[i]
+    if (arg instanceof Error) {
+      err = arg
+      status = err.status || err.statusCode || status
+      continue
+    }
+    switch (typeof arg) {
+      case 'string':
+        msg = arg
+        break
+      case 'number':
+        status = arg
+        break
+      case 'object':
+        props = arg
+        break
+    }
+  }
+
+  if (typeof status !== 'number' || !statuses[status]) {
+    status = 500
+  }
+
+  // constructor
+  var HttpError = createError[status]
+
+  if (!err) {
+    // create error
+    err = HttpError
+      ? new HttpError(msg)
+      : new Error(msg || statuses[status])
+    Error.captureStackTrace(err, createError)
+  }
+
+  if (!HttpError || !(err instanceof HttpError)) {
+    // add properties to generic error
+    err.expose = status < 500
+    err.status = err.statusCode = status
+  }
+
+  for (var key in props) {
+    if (key !== 'status' && key !== 'statusCode') {
+      err[key] = props[key]
+    }
+  }
+
+  return err
+}
+
+/**
+ * Create HTTP error abstract base class.
+ * @private
+ */
+
+function createHttpErrorConstructor () {
+  function HttpError () {
+    throw new TypeError('cannot construct abstract class')
+  }
+
+  inherits(HttpError, Error)
+
+  return HttpError
+}
+
+/**
+ * Create a constructor for a client error.
+ * @private
+ */
+
+function createClientErrorConstructor (HttpError, name, code) {
+  var className = name.match(/Error$/) ? name : name + 'Error'
+
+  function ClientError (message) {
+    // create the error object
+    var err = new Error(message != null ? message : statuses[code])
+
+    // capture a stack trace to the construction point
+    Error.captureStackTrace(err, ClientError)
+
+    // adjust the [[Prototype]]
+    setPrototypeOf(err, ClientError.prototype)
+
+    // redefine the error name
+    Object.defineProperty(err, 'name', {
+      enumerable: false,
+      configurable: true,
+      value: className,
+      writable: true
+    })
+
+    return err
+  }
+
+  inherits(ClientError, HttpError)
+
+  ClientError.prototype.status = code
+  ClientError.prototype.statusCode = code
+  ClientError.prototype.expose = true
+
+  return ClientError
+}
+
+/**
+ * Create a constructor for a server error.
+ * @private
+ */
+
+function createServerErrorConstructor (HttpError, name, code) {
+  var className = name.match(/Error$/) ? name : name + 'Error'
+
+  function ServerError (message) {
+    // create the error object
+    var err = new Error(message != null ? message : statuses[code])
+
+    // capture a stack trace to the construction point
+    Error.captureStackTrace(err, ServerError)
+
+    // adjust the [[Prototype]]
+    setPrototypeOf(err, ServerError.prototype)
+
+    // redefine the error name
+    Object.defineProperty(err, 'name', {
+      enumerable: false,
+      configurable: true,
+      value: className,
+      writable: true
+    })
+
+    return err
+  }
+
+  inherits(ServerError, HttpError)
+
+  ServerError.prototype.status = code
+  ServerError.prototype.statusCode = code
+  ServerError.prototype.expose = false
+
+  return ServerError
+}
+
+/**
+ * Populate the exports object with constructors for every error class.
+ * @private
+ */
+
+function populateConstructorExports (exports, codes, HttpError) {
+  codes.forEach(function forEachCode (code) {
+    var CodeError
+    var name = toIdentifier(statuses[code])
+
+    switch (String(code).charAt(0)) {
+      case '4':
+        CodeError = createClientErrorConstructor(HttpError, name, code)
+        break
+      case '5':
+        CodeError = createServerErrorConstructor(HttpError, name, code)
+        break
+    }
+
+    if (CodeError) {
+      // export the constructor
+      exports[code] = CodeError
+      exports[name] = CodeError
+    }
+  })
+
+  // backwards-compatibility
+  exports["I'mateapot"] = exports.ImATeapot
+}
+
+/**
+ * Convert a string of words to a JavaScript identifier.
+ * @private
+ */
+
+function toIdentifier (str) {
+  return str.split(' ').map(function (token) {
+    return token.slice(0, 1).toUpperCase() + token.slice(1)
+  }).join('').replace(/[^ _0-9a-z]/gi, '')
+}
diff --git a/node_modules/csurf/node_modules/http-errors/node_modules/inherits/LICENSE b/node_modules/csurf/node_modules/http-errors/node_modules/inherits/LICENSE
new file mode 100644
index 0000000..dea3013
--- /dev/null
+++ b/node_modules/csurf/node_modules/http-errors/node_modules/inherits/LICENSE
@@ -0,0 +1,16 @@
+The ISC License
+
+Copyright (c) Isaac Z. Schlueter
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND
+FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+PERFORMANCE OF THIS SOFTWARE.
+
diff --git a/node_modules/csurf/node_modules/http-errors/node_modules/inherits/README.md b/node_modules/csurf/node_modules/http-errors/node_modules/inherits/README.md
new file mode 100644
index 0000000..b1c5665
--- /dev/null
+++ b/node_modules/csurf/node_modules/http-errors/node_modules/inherits/README.md
@@ -0,0 +1,42 @@
+Browser-friendly inheritance fully compatible with standard node.js
+[inherits](http://nodejs.org/api/util.html#util_util_inherits_constructor_superconstructor).
+
+This package exports standard `inherits` from node.js `util` module in
+node environment, but also provides alternative browser-friendly
+implementation through [browser
+field](https://gist.github.com/shtylman/4339901). Alternative
+implementation is a literal copy of standard one located in standalone
+module to avoid requiring of `util`. It also has a shim for old
+browsers with no `Object.create` support.
+
+While keeping you sure you are using standard `inherits`
+implementation in node.js environment, it allows bundlers such as
+[browserify](https://github.com/substack/node-browserify) to not
+include full `util` package to your client code if all you need is
+just `inherits` function. It worth, because browser shim for `util`
+package is large and `inherits` is often the single function you need
+from it.
+
+It's recommended to use this package instead of
+`require('util').inherits` for any code that has chances to be used
+not only in node.js but in browser too.
+
+## usage
+
+```js
+var inherits = require('inherits');
+// then use exactly as the standard one
+```
+
+## note on version ~1.0
+
+Version ~1.0 had completely different motivation and is not compatible
+neither with 2.0 nor with standard node.js `inherits`.
+
+If you are using version ~1.0 and planning to switch to ~2.0, be
+careful:
+
+* new version uses `super_` instead of `super` for referencing
+  superclass
+* new version overwrites current prototype while old one preserves any
+  existing fields on it
diff --git a/node_modules/csurf/node_modules/http-errors/node_modules/inherits/inherits.js b/node_modules/csurf/node_modules/http-errors/node_modules/inherits/inherits.js
new file mode 100644
index 0000000..29f5e24
--- /dev/null
+++ b/node_modules/csurf/node_modules/http-errors/node_modules/inherits/inherits.js
@@ -0,0 +1 @@
+module.exports = require('util').inherits
diff --git a/node_modules/csurf/node_modules/http-errors/node_modules/inherits/inherits_browser.js b/node_modules/csurf/node_modules/http-errors/node_modules/inherits/inherits_browser.js
new file mode 100644
index 0000000..c1e78a7
--- /dev/null
+++ b/node_modules/csurf/node_modules/http-errors/node_modules/inherits/inherits_browser.js
@@ -0,0 +1,23 @@
+if (typeof Object.create === 'function') {
+  // implementation from standard node.js 'util' module
+  module.exports = function inherits(ctor, superCtor) {
+    ctor.super_ = superCtor
+    ctor.prototype = Object.create(superCtor.prototype, {
+      constructor: {
+        value: ctor,
+        enumerable: false,
+        writable: true,
+        configurable: true
+      }
+    });
+  };
+} else {
+  // old school shim for old browsers
+  module.exports = function inherits(ctor, superCtor) {
+    ctor.super_ = superCtor
+    var TempCtor = function () {}
+    TempCtor.prototype = superCtor.prototype
+    ctor.prototype = new TempCtor()
+    ctor.prototype.constructor = ctor
+  }
+}
diff --git a/node_modules/csurf/node_modules/http-errors/node_modules/inherits/package.json b/node_modules/csurf/node_modules/http-errors/node_modules/inherits/package.json
new file mode 100644
index 0000000..b7b5b01
--- /dev/null
+++ b/node_modules/csurf/node_modules/http-errors/node_modules/inherits/package.json
@@ -0,0 +1,50 @@
+{
+  "name": "inherits",
+  "description": "Browser-friendly inheritance fully compatible with standard node.js inherits()",
+  "version": "2.0.1",
+  "keywords": [
+    "inheritance",
+    "class",
+    "klass",
+    "oop",
+    "object-oriented",
+    "inherits",
+    "browser",
+    "browserify"
+  ],
+  "main": "./inherits.js",
+  "browser": "./inherits_browser.js",
+  "repository": {
+    "type": "git",
+    "url": "git://github.com/isaacs/inherits.git"
+  },
+  "license": "ISC",
+  "scripts": {
+    "test": "node test"
+  },
+  "bugs": {
+    "url": "https://github.com/isaacs/inherits/issues"
+  },
+  "_id": "inherits@2.0.1",
+  "dist": {
+    "shasum": "b17d08d326b4423e568eff719f91b0b1cbdf69f1",
+    "tarball": "https://registry.npmjs.org/inherits/-/inherits-2.0.1.tgz"
+  },
+  "_from": "inherits@2.0.1",
+  "_npmVersion": "1.3.8",
+  "_npmUser": {
+    "name": "isaacs",
+    "email": "i@izs.me"
+  },
+  "maintainers": [
+    {
+      "name": "isaacs",
+      "email": "i@izs.me"
+    }
+  ],
+  "directories": {},
+  "_shasum": "b17d08d326b4423e568eff719f91b0b1cbdf69f1",
+  "_resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.1.tgz",
+  "readme": "ERROR: No README data found!",
+  "homepage": "https://github.com/isaacs/inherits#readme"
+}
diff --git a/node_modules/csurf/node_modules/http-errors/node_modules/inherits/test.js b/node_modules/csurf/node_modules/http-errors/node_modules/inherits/test.js
new file mode 100644
index 0000000..fc53012
--- /dev/null
+++ b/node_modules/csurf/node_modules/http-errors/node_modules/inherits/test.js
@@ -0,0 +1,25 @@
+var inherits = require('./inherits.js')
+var assert = require('assert')
+
+function test(c) {
+  assert(c.constructor === Child)
+  assert(c.constructor.super_ === Parent)
+  assert(Object.getPrototypeOf(c) === Child.prototype)
+  assert(Object.getPrototypeOf(Object.getPrototypeOf(c)) === Parent.prototype)
+  assert(c instanceof Child)
+  assert(c instanceof Parent)
+}
+
+function Child() {
+  Parent.call(this)
+  test(this)
+}
+
+function Parent() {}
+
+inherits(Child, Parent)
+
+var c = new Child
+test(c)
+
+console.log('ok')
diff --git a/node_modules/csurf/node_modules/http-errors/node_modules/setprototypeof/LICENSE b/node_modules/csurf/node_modules/http-errors/node_modules/setprototypeof/LICENSE
new file mode 100644
index 0000000..61afa2f
--- /dev/null
+++ b/node_modules/csurf/node_modules/http-errors/node_modules/setprototypeof/LICENSE
@@ -0,0 +1,13 @@
+Copyright (c) 2015, Wes Todd
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
diff --git a/node_modules/csurf/node_modules/http-errors/node_modules/setprototypeof/README.md b/node_modules/csurf/node_modules/http-errors/node_modules/setprototypeof/README.md
new file mode 100644
index 0000000..01d7947
--- /dev/null
+++ b/node_modules/csurf/node_modules/http-errors/node_modules/setprototypeof/README.md
@@ -0,0 +1,21 @@
+# Polyfill for `Object.setPrototypeOf`
+
+A simple cross platform implementation to set the prototype of an instianted object.  Supports all modern browsers and at least back to IE8.
+
+## Usage:
+
+```
+$ npm install --save setprototypeof
+```
+
+```javascript
+var setPrototypeOf = require('setprototypeof');
+
+var obj = {};
+setPrototypeOf(obj, {
+	foo: function() {
+		return 'bar';
+	}
+});
+obj.foo(); // bar
+```
diff --git a/node_modules/csurf/node_modules/http-errors/node_modules/setprototypeof/index.js b/node_modules/csurf/node_modules/http-errors/node_modules/setprototypeof/index.js
new file mode 100644
index 0000000..086a879
--- /dev/null
+++ b/node_modules/csurf/node_modules/http-errors/node_modules/setprototypeof/index.js
@@ -0,0 +1,11 @@
+module.exports = Object.setPrototypeOf || ({__proto__:[]} instanceof Array ? setProtoOf : mixinProperties);
+
+function setProtoOf(obj, proto) {
+	obj.__proto__ = proto;
+}
+
+function mixinProperties(obj, proto) {
+	for (var prop in proto) {
+		obj[prop] = proto[prop];
+	}
+}
diff --git a/node_modules/csurf/node_modules/http-errors/node_modules/setprototypeof/package.json b/node_modules/csurf/node_modules/http-errors/node_modules/setprototypeof/package.json
new file mode 100644
index 0000000..643ae9f
--- /dev/null
+++ b/node_modules/csurf/node_modules/http-errors/node_modules/setprototypeof/package.json
@@ -0,0 +1,53 @@
+{
+  "name": "setprototypeof",
+  "version": "1.0.1",
+  "description": "A small polyfill for Object.setprototypeof",
+  "main": "index.js",
+  "scripts": {
+    "test": "echo \"Error: no test specified\" && exit 1"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/wesleytodd/setprototypeof.git"
+  },
+  "keywords": [
+    "polyfill",
+    "object",
+    "setprototypeof"
+  ],
+  "author": {
+    "name": "Wes Todd"
+  },
+  "license": "ISC",
+  "bugs": {
+    "url": "https://github.com/wesleytodd/setprototypeof/issues"
+  },
+  "homepage": "https://github.com/wesleytodd/setprototypeof",
+  "gitHead": "1e3d0cde6b7f4a9fba10cd28e62b200c9d8f899f",
+  "_id": "setprototypeof@1.0.1",
+  "_shasum": "52009b27888c4dc48f591949c0a8275834c1ca7e",
+  "_from": "setprototypeof@1.0.1",
+  "_npmVersion": "3.3.6",
+  "_nodeVersion": "5.0.0",
+  "_npmUser": {
+    "name": "wesleytodd",
+    "email": "wes@wesleytodd.com"
+  },
+  "dist": {
+    "shasum": "52009b27888c4dc48f591949c0a8275834c1ca7e",
+    "tarball": "https://registry.npmjs.org/setprototypeof/-/setprototypeof-1.0.1.tgz"
+  },
+  "maintainers": [
+    {
+      "name": "wesleytodd",
+      "email": "wes@wesleytodd.com"
+    }
+  ],
+  "_npmOperationalInternal": {
+    "host": "packages-5-east.internal.npmjs.com",
+    "tmp": "tmp/setprototypeof-1.0.1.tgz_1454803015119_0.7522649802267551"
+  },
+  "directories": {},
+  "_resolved": "https://registry.npmjs.org/setprototypeof/-/setprototypeof-1.0.1.tgz",
+  "readme": "ERROR: No README data found!"
+}
diff --git a/node_modules/csurf/node_modules/http-errors/node_modules/statuses/HISTORY.md b/node_modules/csurf/node_modules/http-errors/node_modules/statuses/HISTORY.md
new file mode 100644
index 0000000..b175575
--- /dev/null
+++ b/node_modules/csurf/node_modules/http-errors/node_modules/statuses/HISTORY.md
@@ -0,0 +1,50 @@
+1.3.0 / 2016-05-17
+==================
+
+  * Add `421 Misdirected Request`
+  * perf: enable strict mode
+
+1.2.1 / 2015-02-01
+==================
+
+  * Fix message for status 451
+    - `451 Unavailable For Legal Reasons`
+
+1.2.0 / 2014-09-28
+==================
+
+  * Add `208 Already Repored`
+  * Add `226 IM Used`
+  * Add `306 (Unused)`
+  * Add `415 Unable For Legal Reasons`
+  * Add `508 Loop Detected`
+
+1.1.1 / 2014-09-24
+==================
+
+  * Add missing 308 to `codes.json`
+
+1.1.0 / 2014-09-21
+==================
+
+  * Add `codes.json` for universal support
+
+1.0.4 / 2014-08-20
+==================
+
+  * Package cleanup
+
+1.0.3 / 2014-06-08
+==================
+
+  * Add 308 to `.redirect` category
+
+1.0.2 / 2014-03-13
+==================
+
+  * Add `.retry` category
+
+1.0.1 / 2014-03-12
+==================
+
+  * Initial release
diff --git a/node_modules/csurf/node_modules/http-errors/node_modules/statuses/LICENSE b/node_modules/csurf/node_modules/http-errors/node_modules/statuses/LICENSE
new file mode 100644
index 0000000..82af4df
--- /dev/null
+++ b/node_modules/csurf/node_modules/http-errors/node_modules/statuses/LICENSE
@@ -0,0 +1,23 @@
+
+The MIT License (MIT)
+
+Copyright (c) 2014 Jonathan Ong me@jongleberry.com
+Copyright (c) 2016 Douglas Christopher Wilson doug@somethingdoug.com
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
diff --git a/node_modules/csurf/node_modules/http-errors/node_modules/statuses/README.md b/node_modules/csurf/node_modules/http-errors/node_modules/statuses/README.md
new file mode 100644
index 0000000..1a699da
--- /dev/null
+++ b/node_modules/csurf/node_modules/http-errors/node_modules/statuses/README.md
@@ -0,0 +1,114 @@
+# Statuses
+
+[![NPM Version][npm-image]][npm-url]
+[![NPM Downloads][downloads-image]][downloads-url]
+[![Node.js Version][node-version-image]][node-version-url]
+[![Build Status][travis-image]][travis-url]
+[![Test Coverage][coveralls-image]][coveralls-url]
+
+HTTP status utility for node.
+
+## API
+
+```js
+var status = require('statuses')
+```
+
+### var code = status(Integer || String)
+
+If `Integer` or `String` is a valid HTTP code or status message, then the appropriate `code` will be returned. Otherwise, an error will be thrown.
+
+```js
+status(403) // => 403
+status('403') // => 403
+status('forbidden') // => 403
+status('Forbidden') // => 403
+status(306) // throws, as it's not supported by node.js
+```
+
+### status.codes
+
+Returns an array of all the status codes as `Integer`s.
+
+### var msg = status[code]
+
+Map of `code` to `status message`. `undefined` for invalid `code`s.
+
+```js
+status[404] // => 'Not Found'
+```
+
+### var code = status[msg]
+
+Map of `status message` to `code`. `msg` can either be title-cased or lower-cased. `undefined` for invalid `status message`s.
+
+```js
+status['not found'] // => 404
+status['Not Found'] // => 404
+```
+
+### status.redirect[code]
+
+Returns `true` if a status code is a valid redirect status.
+
+```js
+status.redirect[200] // => undefined
+status.redirect[301] // => true
+```
+
+### status.empty[code]
+
+Returns `true` if a status code expects an empty body.
+
+```js
+status.empty[200] // => undefined
+status.empty[204] // => true
+status.empty[304] // => true
+```
+
+### status.retry[code]
+
+Returns `true` if you should retry the rest.
+
+```js
+status.retry[501] // => undefined
+status.retry[503] // => true
+```
+
+### statuses/codes.json
+
+```js
+var codes = require('statuses/codes.json')
+```
+
+This is a JSON file of the status codes
+taken from `require('http').STATUS_CODES`.
+This is saved so that codes are consistent even in older node.js versions.
+For example, `308` will be added in v0.12.
+
+## Adding Status Codes
+
+The status codes are primarily sourced from http://www.iana.org/assignments/http-status-codes/http-status-codes-1.csv.
+Additionally, custom codes are added from http://en.wikipedia.org/wiki/List_of_HTTP_status_codes.
+These are added manually in the `lib/*.json` files.
+If you would like to add a status code, add it to the appropriate JSON file.
+
+To rebuild `codes.json`, run the following:
+
+```bash
+# update src/iana.json
+npm run fetch
+# build codes.json
+npm run build
+```
+
+[npm-image]: https://img.shields.io/npm/v/statuses.svg
+[npm-url]: https://npmjs.org/package/statuses
+[node-version-image]: https://img.shields.io/badge/node.js-%3E%3D_0.6-brightgreen.svg
+[node-version-url]: https://nodejs.org/en/download
+[travis-image]: https://img.shields.io/travis/jshttp/statuses.svg
+[travis-url]: https://travis-ci.org/jshttp/statuses
+[coveralls-image]: https://img.shields.io/coveralls/jshttp/statuses.svg
+[coveralls-url]: https://coveralls.io/r/jshttp/statuses?branch=master
+[downloads-image]: https://img.shields.io/npm/dm/statuses.svg
+[downloads-url]: https://npmjs.org/package/statuses
diff --git a/node_modules/csurf/node_modules/http-errors/node_modules/statuses/codes.json b/node_modules/csurf/node_modules/http-errors/node_modules/statuses/codes.json
new file mode 100644
index 0000000..e765123
--- /dev/null
+++ b/node_modules/csurf/node_modules/http-errors/node_modules/statuses/codes.json
@@ -0,0 +1,65 @@
+{
+  "100": "Continue",
+  "101": "Switching Protocols",
+  "102": "Processing",
+  "200": "OK",
+  "201": "Created",
+  "202": "Accepted",
+  "203": "Non-Authoritative Information",
+  "204": "No Content",
+  "205": "Reset Content",
+  "206": "Partial Content",
+  "207": "Multi-Status",
+  "208": "Already Reported",
+  "226": "IM Used",
+  "300": "Multiple Choices",
+  "301": "Moved Permanently",
+  "302": "Found",
+  "303": "See Other",
+  "304": "Not Modified",
+  "305": "Use Proxy",
+  "306": "(Unused)",
+  "307": "Temporary Redirect",
+  "308": "Permanent Redirect",
+  "400": "Bad Request",
+  "401": "Unauthorized",
+  "402": "Payment Required",
+  "403": "Forbidden",
+  "404": "Not Found",
+  "405": "Method Not Allowed",
+  "406": "Not Acceptable",
+  "407": "Proxy Authentication Required",
+  "408": "Request Timeout",
+  "409": "Conflict",
+  "410": "Gone",
+  "411": "Length Required",
+  "412": "Precondition Failed",
+  "413": "Payload Too Large",
+  "414": "URI Too Long",
+  "415": "Unsupported Media Type",
+  "416": "Range Not Satisfiable",
+  "417": "Expectation Failed",
+  "418": "I'm a teapot",
+  "421": "Misdirected Request",
+  "422": "Unprocessable Entity",
+  "423": "Locked",
+  "424": "Failed Dependency",
+  "425": "Unordered Collection",
+  "426": "Upgrade Required",
+  "428": "Precondition Required",
+  "429": "Too Many Requests",
+  "431": "Request Header Fields Too Large",
+  "451": "Unavailable For Legal Reasons",
+  "500": "Internal Server Error",
+  "501": "Not Implemented",
+  "502": "Bad Gateway",
+  "503": "Service Unavailable",
+  "504": "Gateway Timeout",
+  "505": "HTTP Version Not Supported",
+  "506": "Variant Also Negotiates",
+  "507": "Insufficient Storage",
+  "508": "Loop Detected",
+  "509": "Bandwidth Limit Exceeded",
+  "510": "Not Extended",
+  "511": "Network Authentication Required"
+}
\ No newline at end of file
diff --git a/node_modules/csurf/node_modules/http-errors/node_modules/statuses/index.js b/node_modules/csurf/node_modules/http-errors/node_modules/statuses/index.js
new file mode 100644
index 0000000..c2b555a
--- /dev/null
+++ b/node_modules/csurf/node_modules/http-errors/node_modules/statuses/index.js
@@ -0,0 +1,110 @@
+/*!
+ * statuses
+ * Copyright(c) 2014 Jonathan Ong
+ * Copyright(c) 2016 Douglas Christopher Wilson
+ * MIT Licensed
+ */
+
+'use strict'
+
+/**
+ * Module dependencies.
+ * @private
+ */
+
+var codes = require('./codes.json')
+
+/**
+ * Module exports.
+ * @public
+ */
+
+module.exports = status
+
+// array of status codes
+status.codes = populateStatusesMap(status, codes)
+
+// status codes for redirects
+status.redirect = {
+  300: true,
+  301: true,
+  302: true,
+  303: true,
+  305: true,
+  307: true,
+  308: true
+}
+
+// status codes for empty bodies
+status.empty = {
+  204: true,
+  205: true,
+  304: true
+}
+
+// status codes for when you should retry the request
+status.retry = {
+  502: true,
+  503: true,
+  504: true
+}
+
+/**
+ * Populate the statuses map for given codes.
+ * @private
+ */
+
+function populateStatusesMap (statuses, codes) {
+  var arr = []
+
+  Object.keys(codes).forEach(function forEachCode (code) {
+    var message = codes[code]
+    var status = Number(code)
+
+    // Populate properties
+    statuses[status] = message
+    statuses[message] = status
+    statuses[message.toLowerCase()] = status
+
+    // Add to array
+    arr.push(status)
+  })
+
+  return arr
+}
+
+/**
+ * Get the status code.
+ *
+ * Given a number, this will throw if it is not a known status
+ * code, otherwise the code will be returned. Given a string,
+ * the string will be parsed for a number and return the code
+ * if valid, otherwise will lookup the code assuming this is
+ * the status message.
+ *
+ * @param {string|number} code
+ * @returns {string}
+ * @public
+ */
+
+function status (code) {
+  if (typeof code === 'number') {
+    if (!status[code]) throw new Error('invalid status code: ' + code)
+    return code
+  }
+
+  if (typeof code !== 'string') {
+    throw new TypeError('code must be a number or string')
+  }
+
+  // '403'
+  var n = parseInt(code, 10)
+  if (!isNaN(n)) {
+    if (!status[n]) throw new Error('invalid status code: ' + n)
+    return n
+  }
+
+  n = status[code.toLowerCase()]
+  if (!n) throw new Error('invalid status message: "' + code + '"')
+  return n
+}
diff --git a/node_modules/csurf/node_modules/http-errors/node_modules/statuses/package.json b/node_modules/csurf/node_modules/http-errors/node_modules/statuses/package.json
new file mode 100644
index 0000000..743f768
--- /dev/null
+++ b/node_modules/csurf/node_modules/http-errors/node_modules/statuses/package.json
@@ -0,0 +1,104 @@
+{
+  "name": "statuses",
+  "description": "HTTP status utility",
+  "version": "1.3.0",
+  "contributors": [
+    {
+      "name": "Douglas Christopher Wilson",
+      "email": "doug@somethingdoug.com"
+    },
+    {
+      "name": "Jonathan Ong",
+      "email": "me@jongleberry.com",
+      "url": "http://jongleberry.com"
+    }
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/jshttp/statuses.git"
+  },
+  "license": "MIT",
+  "keywords": [
+    "http",
+    "status",
+    "code"
+  ],
+  "files": [
+    "HISTORY.md",
+    "index.js",
+    "codes.json",
+    "LICENSE"
+  ],
+  "devDependencies": {
+    "csv-parse": "1.0.1",
+    "eslint": "2.10.2",
+    "eslint-config-standard": "5.3.1",
+    "eslint-plugin-promise": "1.1.0",
+    "eslint-plugin-standard": "1.3.2",
+    "istanbul": "0.4.3",
+    "mocha": "1.21.5",
+    "stream-to-array": "2.2.0"
+  },
+  "engines": {
+    "node": ">= 0.6"
+  },
+  "scripts": {
+    "build": "node scripts/build.js",
+    "fetch": "node scripts/fetch.js",
+    "lint": "eslint **/*.js",
+    "test": "mocha --reporter spec --check-leaks --bail test/",
+    "test-ci": "istanbul cover node_modules/mocha/bin/_mocha --report lcovonly -- --reporter spec --check-leaks test/",
+    "test-cov": "istanbul cover node_modules/mocha/bin/_mocha -- --reporter dot --check-leaks test/",
+    "update": "npm run fetch && npm run build"
+  },
+  "gitHead": "b3e31e8c32dd8107e898b44b8c0b2dfff3cba495",
+  "bugs": {
+    "url": "https://github.com/jshttp/statuses/issues"
+  },
+  "homepage": "https://github.com/jshttp/statuses",
+  "_id": "statuses@1.3.0",
+  "_shasum": "8e55758cb20e7682c1f4fce8dcab30bf01d1e07a",
+  "_from": "statuses@>=1.3.0 <2.0.0",
+  "_npmVersion": "1.4.28",
+  "_npmUser": {
+    "name": "dougwilson",
+    "email": "doug@somethingdoug.com"
+  },
+  "maintainers": [
+    {
+      "name": "defunctzombie",
+      "email": "shtylman@gmail.com"
+    },
+    {
+      "name": "dougwilson",
+      "email": "doug@somethingdoug.com"
+    },
+    {
+      "name": "fishrock123",
+      "email": "fishrock123@rocketmail.com"
+    },
+    {
+      "name": "jongleberry",
+      "email": "jonathanrichardong@gmail.com"
+    },
+    {
+      "name": "mscdex",
+      "email": "mscdex@mscdex.net"
+    },
+    {
+      "name": "tjholowaychuk",
+      "email": "tj@vision-media.ca"
+    }
+  ],
+  "dist": {
+    "shasum": "8e55758cb20e7682c1f4fce8dcab30bf01d1e07a",
+    "tarball": "https://registry.npmjs.org/statuses/-/statuses-1.3.0.tgz"
+  },
+  "_npmOperationalInternal": {
+    "host": "packages-12-west.internal.npmjs.com",
+    "tmp": "tmp/statuses-1.3.0.tgz_1463517875633_0.19560232176445425"
+  },
+  "directories": {},
+  "_resolved": "https://registry.npmjs.org/statuses/-/statuses-1.3.0.tgz",
+  "readme": "ERROR: No README data found!"
+}
diff --git a/node_modules/csurf/node_modules/http-errors/package.json b/node_modules/csurf/node_modules/http-errors/package.json
new file mode 100644
index 0000000..245ddac
--- /dev/null
+++ b/node_modules/csurf/node_modules/http-errors/package.json
@@ -0,0 +1,96 @@
+{
+  "name": "http-errors",
+  "description": "Create HTTP error objects",
+  "version": "1.5.0",
+  "author": {
+    "name": "Jonathan Ong",
+    "email": "me@jongleberry.com",
+    "url": "http://jongleberry.com"
+  },
+  "contributors": [
+    {
+      "name": "Alan Plum",
+      "email": "me@pluma.io"
+    },
+    {
+      "name": "Douglas Christopher Wilson",
+      "email": "doug@somethingdoug.com"
+    }
+  ],
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/jshttp/http-errors.git"
+  },
+  "dependencies": {
+    "inherits": "2.0.1",
+    "setprototypeof": "1.0.1",
+    "statuses": ">= 1.3.0 < 2"
+  },
+  "devDependencies": {
+    "eslint": "2.10.2",
+    "eslint-config-standard": "5.3.1",
+    "eslint-plugin-promise": "1.1.0",
+    "eslint-plugin-standard": "1.3.2",
+    "istanbul": "0.4.3",
+    "mocha": "1.21.5"
+  },
+  "engines": {
+    "node": ">= 0.6"
+  },
+  "scripts": {
+    "lint": "eslint **/*.js",
+    "test": "mocha --reporter spec --bail",
+    "test-cov": "istanbul cover node_modules/mocha/bin/_mocha -- --reporter dot",
+    "test-travis": "istanbul cover node_modules/mocha/bin/_mocha --report lcovonly -- --reporter dot"
+  },
+  "keywords": [
+    "http",
+    "error"
+  ],
+  "files": [
+    "index.js",
+    "HISTORY.md",
+    "LICENSE",
+    "README.md"
+  ],
+  "gitHead": "1a826d7ac31dde16931b9c566041697939ebd0e0",
+  "bugs": {
+    "url": "https://github.com/jshttp/http-errors/issues"
+  },
+  "homepage": "https://github.com/jshttp/http-errors#readme",
+  "_id": "http-errors@1.5.0",
+  "_shasum": "b1cb3d8260fd8e2386cad3189045943372d48211",
+  "_from": "http-errors@>=1.5.0 <1.6.0",
+  "_npmVersion": "2.15.1",
+  "_nodeVersion": "4.4.3",
+  "_npmUser": {
+    "name": "dougwilson",
+    "email": "doug@somethingdoug.com"
+  },
+  "dist": {
+    "shasum": "b1cb3d8260fd8e2386cad3189045943372d48211",
+    "tarball": "https://registry.npmjs.org/http-errors/-/http-errors-1.5.0.tgz"
+  },
+  "maintainers": [
+    {
+      "name": "dougwilson",
+      "email": "doug@somethingdoug.com"
+    },
+    {
+      "name": "egeste",
+      "email": "npm@egeste.net"
+    },
+    {
+      "name": "jongleberry",
+      "email": "jonathanrichardong@gmail.com"
+    }
+  ],
+  "_npmOperationalInternal": {
+    "host": "packages-16-east.internal.npmjs.com",
+    "tmp": "tmp/http-errors-1.5.0.tgz_1463621678183_0.44013352948240936"
+  },
+  "directories": {},
+  "_resolved": "https://registry.npmjs.org/http-errors/-/http-errors-1.5.0.tgz",
+  "readme": "ERROR: No README data found!"
+}
diff --git a/node_modules/csurf/package.json b/node_modules/csurf/package.json
index 8954e8f..defaf0a 100644
--- a/node_modules/csurf/package.json
+++ b/node_modules/csurf/package.json
@@ -64,7 +64,7 @@
   "homepage": "https://github.com/expressjs/csurf",
   "_id": "csurf@1.9.0",
   "_shasum": "49d2c6925ffcec7b7de559597c153fa533364133",
-  "_from": "csurf@latest",
+  "_from": "csurf@>=1.9.0 <2.0.0",
   "_npmVersion": "1.4.28",
   "_npmUser": {
     "name": "dougwilson",