need pull

37 files changed, 2516 insertions, 0 deletions

diff --git a/node_modules/csurf/HISTORY.md b/node_modules/csurf/HISTORY.md
new file mode 100644
index 0000000..06019ed
--- /dev/null
+++ b/node_modules/csurf/HISTORY.md
@@ -0,0 +1,158 @@
+1.9.0 / 2016-05-27
+==================
+
+  * Pass invalid csrf token error to `next()` instead of throwing
+  * Pass misconfigured error to `next()` instead of throwing
+  * Provide misconfigured error when using cookies without cookie-parser
+  * deps: cookie@0.3.1
+    - Add `sameSite` option
+    - Fix cookie `Max-Age` to never be a floating point number
+    - Improve error message when `expires` is not a `Date`
+    - Throw better error for invalid argument to parse
+    - Throw on invalid values provided to `serialize`
+    - perf: enable strict mode
+    - perf: hoist regular expression
+    - perf: use for loop in parse
+    - perf: use string concatination for serialization
+  * deps: csrf@~3.0.3
+    - Use `tsscmp` module for timing-safe token verification
+    - deps: base64-url@1.2.2
+    - deps: rndm@1.2.0
+    - deps: uid-safe@2.1.1
+  * deps: http-errors@~1.5.0
+    - Add `HttpError` export, for `err instanceof createError.HttpError`
+    - Support new code `421 Misdirected Request`
+    - Use `setprototypeof` module to replace `__proto__` setting
+    - deps: inherits@2.0.1
+    - deps: statuses@'>= 1.3.0 < 2'
+    - perf: enable strict mode
+  * perf: enable strict mode
+  * perf: remove argument reassignment
+
+1.8.3 / 2015-06-10
+==================
+
+  * deps: cookie@0.1.3
+    - Slight optimizations
+
+1.8.2 / 2015-05-09
+==================
+
+  * deps: csrf@~3.0.0
+    - deps: uid-safe@~2.0.0
+
+1.8.1 / 2015-05-03
+==================
+
+  * deps: csrf@~2.0.7
+    - Fix compatibility with `crypto.DEFAULT_ENCODING` global changes
+
+1.8.0 / 2015-04-07
+==================
+
+  * Add `sessionKey` option
+
+1.7.0 / 2015-02-15
+==================
+
+  * Accept `CSRF-Token` and `XSRF-Token` request headers
+  * Default `cookie.path` to `'/'`, if using cookies
+  * deps: cookie-signature@1.0.6
+  * deps: csrf@~2.0.6
+    - deps: base64-url@1.2.1
+    - deps: uid-safe@~1.1.0
+  * deps: http-errors@~1.3.1
+   - Construct errors using defined constructors from `createError`
+   - Fix error names that are not identifiers
+   - Set a meaningful `name` property on constructed errors
+
+1.6.6 / 2015-01-31
+==================
+
+  * deps: csrf@~2.0.5
+    - deps: base64-url@1.2.0
+    - deps: uid-safe@~1.0.3
+
+1.6.5 / 2015-01-08
+==================
+
+  * deps: csrf@~2.0.4
+    - deps: uid-safe@~1.0.2
+
+1.6.4 / 2014-12-30
+==================
+
+  * deps: csrf@~2.0.3
+    - Slight speed improvement for `verify`
+    - deps: base64-url@1.1.0
+    - deps: rndm@~1.1.0
+  * deps: http-errors@~1.2.8
+   - Fix stack trace from exported function
+
+1.6.3 / 2014-11-09
+==================
+
+  * deps: csrf@~2.0.2
+    - deps: scmp@1.0.0
+  * deps: http-errors@~1.2.7
+   - Remove duplicate line
+
+1.6.2 / 2014-10-14
+==================
+
+  * Fix cookie name when using `cookie: true`
+  * deps: http-errors@~1.2.6
+    - Fix `expose` to be `true` for `ClientError` constructor
+    - Use `inherits` instead of `util`
+    - deps: statuses@1
+
+1.6.1 / 2014-09-05
+==================
+
+  * deps: cookie-signature@1.0.5
+
+1.6.0 / 2014-09-03
+==================
+
+  * Set `code` property on CSRF token errors
+
+1.5.0 / 2014-08-24
+==================
+
+  * Add `ignoreMethods` option
+
+1.4.1 / 2014-08-22
+==================
+
+  * Use `csrf-tokens` instead of `csrf`
+ 
+1.4.0 / 2014-07-30
+==================
+
+  * Support changing `req.session` after `csurf` middleware
+    - Calling `res.csrfToken()` after `req.session.destroy()` will now work
+
+1.3.0 / 2014-07-03
+==================
+
+  * Add support for environments without `res.cookie` (connect@3)
+
+1.2.2 / 2014-06-18
+==================
+
+  * deps: csrf-tokens@~2.0.0
+
+1.2.1 / 2014-06-09
+==================
+
+  * Refactor to use `csrf-tokens` module
+
+1.2.0 / 2014-05-13
+==================
+
+  * Add support for double-submit cookie
+
+1.1.0 / 2014-04-06
+==================
+
+  * Add constant-time string compare
diff --git a/node_modules/csurf/LICENSE b/node_modules/csurf/LICENSE
new file mode 100644
index 0000000..4abfea8
--- /dev/null
+++ b/node_modules/csurf/LICENSE
@@ -0,0 +1,23 @@
+(The MIT License)
+
+Copyright (c) 2014 Jonathan Ong <me@jongleberry.com>
+Copyright (c) 2014-2016 Douglas Christopher Wilson <doug@somethingdoug.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
diff --git a/node_modules/csurf/README.md b/node_modules/csurf/README.md
new file mode 100644
index 0000000..dc88802
--- /dev/null
+++ b/node_modules/csurf/README.md
@@ -0,0 +1,238 @@
+# csurf
+
+[![NPM Version][npm-image]][npm-url]
+[![NPM Downloads][downloads-image]][downloads-url]
+[![Build status][travis-image]][travis-url]
+[![Test coverage][coveralls-image]][coveralls-url]
+[![Gratipay][gratipay-image]][gratipay-url]
+
+Node.js [CSRF](https://en.wikipedia.org/wiki/Cross-site_request_forgery) protection middleware.
+
+Requires either a session middleware or [cookie-parser](https://www.npmjs.com/package/cookie-parser) to be initialized first.
+
+  * If you are setting the ["cookie" option](#cookie) to a non-`false` value,
+    then you must use [cookie-parser](https://www.npmjs.com/package/cookie-parser)
+    before this module.
+  * Otherwise, you must use a session middleware before this module. For example:
+    - [express-session](https://www.npmjs.com/package/express-session)
+    - [cookie-session](https://www.npmjs.com/package/cookie-session)
+
+If you have questions on how this module is implemented, please read
+[Understanding CSRF](https://github.com/pillarjs/understanding-csrf).
+
+## Installation
+
+```sh
+$ npm install csurf
+```
+
+## API
+
+```js
+var csurf = require('csurf')
+```
+
+### csurf([options])
+
+Create a middleware for CSRF token creation and validation. This middleware
+adds a `req.csrfToken()` function to make a token which should be added to
+requests which mutate state, within a hidden form field, query-string etc.
+This token is validated against the visitor's session or csrf cookie.
+
+#### Options
+
+The `csurf` function takes an optional `options` object that may contain
+any of the following keys:
+
+##### cookie
+
+Determines if the token secret for the user should be stored in a cookie
+or in `req.session`. Defaults to `false`.
+
+When set to `true` (or an object of options for the cookie), then the module
+changes behavior and no longer uses `req.session`. This means you _are no
+longer required to use a session middleware_. Instead, you do need to use the
+[cookie-parser](https://www.npmjs.com/package/cookie-parser) middleware in
+your app before this middleware.
+
+When set to an object, cookie storage of the secret is enabled and the
+object contains options for this functionality (when set to `true`, the
+defaults for the options are used). The options may contain any of the
+following keys:
+
+  - `key` - the name of the cookie to use to store the token secret
+    (defaults to `'_csrf'`).
+  - `path` - the path of the cookie (defaults to `'/'`).
+  - any other [res.cookie](http://expressjs.com/4x/api.html#res.cookie)
+    option can be set.
+
+##### ignoreMethods
+
+An array of the methods for which CSRF token checking will disabled.
+Defaults to `['GET', 'HEAD', 'OPTIONS']`.
+
+##### sessionKey
+
+Determines what property ("key") on `req` the session object is located.
+Defaults to `'session'` (i.e. looks at `req.session`). The CSRF secret
+from this library is stored and read as `req[sessionKey].csrfSecret`.
+
+If the ["cookie" option](#cookie) is not `false`, then this option does
+nothing.
+
+##### value
+
+Provide a function that the middleware will invoke to read the token from
+the request for validation. The function is called as `value(req)` and is
+expected to return the token as a string.
+
+The default value is a function that reads the token from the following
+locations, in order:
+
+  - `req.body._csrf` - typically generated by the `body-parser` module.
+  - `req.query._csrf` - a built-in from Express.js to read from the URL
+    query string.
+  - `req.headers['csrf-token']` - the `CSRF-Token` HTTP request header.
+  - `req.headers['xsrf-token']` - the `XSRF-Token` HTTP request header.
+  - `req.headers['x-csrf-token']` - the `X-CSRF-Token` HTTP request header.
+  - `req.headers['x-xsrf-token']` - the `X-XSRF-Token` HTTP request header.
+
+## Example
+
+### Simple express example
+
+The following is an example of some server-side code that generates a form
+that requires a CSRF token to post back.
+
+```js
+var cookieParser = require('cookie-parser')
+var csrf = require('csurf')
+var bodyParser = require('body-parser')
+var express = require('express')
+
+// setup route middlewares
+var csrfProtection = csrf({ cookie: true })
+var parseForm = bodyParser.urlencoded({ extended: false })
+
+// create express app
+var app = express()
+
+// parse cookies
+// we need this because "cookie" is true in csrfProtection
+app.use(cookieParser())
+
+app.get('/form', csrfProtection, function(req, res) {
+  // pass the csrfToken to the view
+  res.render('send', { csrfToken: req.csrfToken() })
+})
+
+app.post('/process', parseForm, csrfProtection, function(req, res) {
+  res.send('data is being processed')
+})
+```
+
+Inside the view (depending on your template language; handlebars-style
+is demonstrated here), set the `csrfToken` value as the value of a hidden
+input field named `_csrf`:
+
+```html
+<form action="/process" method="POST">
+  <input type="hidden" name="_csrf" value="{{csrfToken}}">
+  
+  Favorite color: <input type="text" name="favoriteColor">
+  <button type="submit">Submit</button>
+</form>
+```
+
+### Ignoring Routes
+
+**Note** CSRF checks should only be disabled for requests that you expect to
+come from outside of your website. Do not disable CSRF checks for requests
+that you expect to only come from your website. An existing session, even if
+it belongs to an authenticated user, is not enough to protect against CSRF
+attacks.
+
+The following is an example of how to order your routes so that certain endpoints
+do not check for a valid CSRF token.
+
+```js
+var cookieParser = require('cookie-parser')
+var csrf = require('csurf')
+var bodyParser = require('body-parser')
+var express = require('express')
+
+// create express app
+var app = express()
+
+// create api router
+var api = createApiRouter()
+
+// mount api before csrf is appended to the app stack
+app.use('/api', api)
+
+// now add csrf and other middlewares, after the "/api" was mounted
+app.use(bodyParser.urlencoded({ extended: false }))
+app.use(cookieParser())
+app.use(csrf({ cookie: true }))
+
+app.get('/form', function(req, res) {
+  // pass the csrfToken to the view
+  res.render('send', { csrfToken: req.csrfToken() })
+})
+
+app.post('/process', function(req, res) {
+  res.send('csrf was required to get here')
+})
+
+function createApiRouter() {
+  var router = new express.Router()
+
+  router.post('/getProfile', function(req, res) {
+    res.send('no csrf to get here')
+  })
+
+  return router
+}
+```
+
+### Custom error handling
+
+When the CSRF token validation fails, an error is thrown that has
+`err.code === 'EBADCSRFTOKEN'`. This can be used to display custom
+error messages.
+
+```js
+var bodyParser = require('body-parser')
+var cookieParser = require('cookie-parser')
+var csrf = require('csurf')
+var express = require('express')
+
+var app = express()
+app.use(bodyParser.urlencoded({ extended: false }))
+app.use(cookieParser())
+app.use(csrf({ cookie: true }))
+
+// error handler
+app.use(function (err, req, res, next) {
+  if (err.code !== 'EBADCSRFTOKEN') return next(err)
+
+  // handle CSRF token errors here
+  res.status(403)
+  res.send('form tampered with')
+})
+```
+
+## License
+
+[MIT](LICENSE)
+
+[npm-image]: https://img.shields.io/npm/v/csurf.svg
+[npm-url]: https://npmjs.org/package/csurf
+[travis-image]: https://img.shields.io/travis/expressjs/csurf/master.svg
+[travis-url]: https://travis-ci.org/expressjs/csurf
+[coveralls-image]: https://img.shields.io/coveralls/expressjs/csurf/master.svg
+[coveralls-url]: https://coveralls.io/r/expressjs/csurf?branch=master
+[downloads-image]: https://img.shields.io/npm/dm/csurf.svg
+[downloads-url]: https://npmjs.org/package/csurf
+[gratipay-image]: https://img.shields.io/gratipay/dougwilson.svg
+[gratipay-url]: https://gratipay.com/dougwilson/
diff --git a/node_modules/csurf/index.js b/node_modules/csurf/index.js
new file mode 100644
index 0000000..9b8c19e
--- /dev/null
+++ b/node_modules/csurf/index.js
@@ -0,0 +1,306 @@
+/*!
+ * csurf
+ * Copyright(c) 2011 Sencha Inc.
+ * Copyright(c) 2014 Jonathan Ong
+ * Copyright(c) 2014-2016 Douglas Christopher Wilson
+ * MIT Licensed
+ */
+
+'use strict'
+
+/**
+ * Module dependencies.
+ * @private
+ */
+
+var Cookie = require('cookie')
+var createError = require('http-errors')
+var sign = require('cookie-signature').sign
+var Tokens = require('csrf')
+
+/**
+ * Module exports.
+ * @public
+ */
+
+module.exports = csurf
+
+/**
+ * CSRF protection middleware.
+ *
+ * This middleware adds a `req.csrfToken()` function to make a token
+ * which should be added to requests which mutate
+ * state, within a hidden form field, query-string etc. This
+ * token is validated against the visitor's session.
+ *
+ * @param {Object} options
+ * @return {Function} middleware
+ * @public
+ */
+
+function csurf (options) {
+  var opts = options || {}
+
+  // get cookie options
+  var cookie = getCookieOptions(opts.cookie)
+
+  // get session options
+  var sessionKey = opts.sessionKey || 'session'
+
+  // get value getter
+  var value = opts.value || defaultValue
+
+  // token repo
+  var tokens = new Tokens(opts)
+
+  // ignored methods
+  var ignoreMethods = opts.ignoreMethods === undefined
+    ? ['GET', 'HEAD', 'OPTIONS']
+    : opts.ignoreMethods
+
+  if (!Array.isArray(ignoreMethods)) {
+    throw new TypeError('option ignoreMethods must be an array')
+  }
+
+  // generate lookup
+  var ignoreMethod = getIgnoredMethods(ignoreMethods)
+
+  return function csrf (req, res, next) {
+    // validate the configuration against request
+    if (!verifyConfiguration(req, sessionKey, cookie)) {
+      return next(new Error('misconfigured csrf'))
+    }
+
+    // get the secret from the request
+    var secret = getSecret(req, sessionKey, cookie)
+    var token
+
+    // lazy-load token getter
+    req.csrfToken = function csrfToken () {
+      var sec = !cookie
+        ? getSecret(req, sessionKey, cookie)
+        : secret
+
+      // use cached token if secret has not changed
+      if (token && sec === secret) {
+        return token
+      }
+
+      // generate & set new secret
+      if (sec === undefined) {
+        sec = tokens.secretSync()
+        setSecret(req, res, sessionKey, sec, cookie)
+      }
+
+      // update changed secret
+      secret = sec
+
+      // create new token
+      token = tokens.create(secret)
+
+      return token
+    }
+
+    // generate & set secret
+    if (!secret) {
+      secret = tokens.secretSync()
+      setSecret(req, res, sessionKey, secret, cookie)
+    }
+
+    // verify the incoming token
+    if (!ignoreMethod[req.method] && !tokens.verify(secret, value(req))) {
+      return next(createError(403, 'invalid csrf token', {
+        code: 'EBADCSRFTOKEN'
+      }))
+    }
+
+    next()
+  }
+}
+
+/**
+ * Default value function, checking the `req.body`
+ * and `req.query` for the CSRF token.
+ *
+ * @param {IncomingMessage} req
+ * @return {String}
+ * @api private
+ */
+
+function defaultValue (req) {
+  return (req.body && req.body._csrf) ||
+    (req.query && req.query._csrf) ||
+    (req.headers['csrf-token']) ||
+    (req.headers['xsrf-token']) ||
+    (req.headers['x-csrf-token']) ||
+    (req.headers['x-xsrf-token'])
+}
+
+/**
+ * Get options for cookie.
+ *
+ * @param {boolean|object} [options]
+ * @returns {object}
+ * @api private
+ */
+
+function getCookieOptions (options) {
+  if (options !== true && typeof options !== 'object') {
+    return undefined
+  }
+
+  var opts = {
+    key: '_csrf',
+    path: '/'
+  }
+
+  if (options && typeof options === 'object') {
+    for (var prop in options) {
+      var val = options[prop]
+
+      if (val !== undefined) {
+        opts[prop] = val
+      }
+    }
+  }
+
+  return opts
+}
+
+/**
+ * Get a lookup of ignored methods.
+ *
+ * @param {array} methods
+ * @returns {object}
+ * @api private
+ */
+
+function getIgnoredMethods (methods) {
+  var obj = Object.create(null)
+
+  for (var i = 0; i < methods.length; i++) {
+    var method = methods[i].toUpperCase()
+    obj[method] = true
+  }
+
+  return obj
+}
+
+/**
+ * Get the token secret from the request.
+ *
+ * @param {IncomingMessage} req
+ * @param {String} sessionKey
+ * @param {Object} [cookie]
+ * @api private
+ */
+
+function getSecret (req, sessionKey, cookie) {
+  // get the bag & key
+  var bag = getSecretBag(req, sessionKey, cookie)
+  var key = cookie ? cookie.key : 'csrfSecret'
+
+  if (!bag) {
+    /* istanbul ignore next: should never actually run */
+    throw new Error('misconfigured csrf')
+  }
+
+  // return secret from bag
+  return bag[key]
+}
+
+/**
+ * Get the token secret bag from the request.
+ *
+ * @param {IncomingMessage} req
+ * @param {String} sessionKey
+ * @param {Object} [cookie]
+ * @api private
+ */
+
+function getSecretBag (req, sessionKey, cookie) {
+  if (cookie) {
+    // get secret from cookie
+    var cookieKey = cookie.signed
+      ? 'signedCookies'
+      : 'cookies'
+
+    return req[cookieKey]
+  } else {
+    // get secret from session
+    return req[sessionKey]
+  }
+}
+
+/**
+ * Set a cookie on the HTTP response.
+ *
+ * @param {OutgoingMessage} res
+ * @param {string} name
+ * @param {string} val
+ * @param {Object} [options]
+ * @api private
+ */
+
+function setCookie (res, name, val, options) {
+  var data = Cookie.serialize(name, val, options)
+
+  var prev = res.getHeader('set-cookie') || []
+  var header = Array.isArray(prev) ? prev.concat(data)
+    : Array.isArray(data) ? [prev].concat(data)
+    : [prev, data]
+
+  res.setHeader('set-cookie', header)
+}
+
+/**
+ * Set the token secret on the request.
+ *
+ * @param {IncomingMessage} req
+ * @param {OutgoingMessage} res
+ * @param {string} sessionKey
+ * @param {string} val
+ * @param {Object} [cookie]
+ * @api private
+ */
+
+function setSecret (req, res, sessionKey, val, cookie) {
+  if (cookie) {
+    // set secret on cookie
+    if (cookie.signed) {
+      var secret = req.secret
+
+      if (!secret) {
+        /* istanbul ignore next: should never actually run */
+        throw new Error('misconfigured csrf')
+      }
+
+      val = 's:' + sign(val, secret)
+    }
+
+    setCookie(res, cookie.key, val, cookie)
+  } else if (req[sessionKey]) {
+    // set secret on session
+    req[sessionKey].csrfSecret = val
+  } else {
+    /* istanbul ignore next: should never actually run */
+    throw new Error('misconfigured csrf')
+  }
+}
+
+/**
+ * Verify the configuration against the request.
+ * @private
+ */
+
+function verifyConfiguration (req, sessionKey, cookie) {
+  if (!getSecretBag(req, sessionKey, cookie)) {
+    return false
+  }
+
+  if (cookie && cookie.signed && !req.secret) {
+    return false
+  }
+
+  return true
+}
diff --git a/node_modules/csurf/node_modules/csrf/HISTORY.md b/node_modules/csurf/node_modules/csrf/HISTORY.md
new file mode 100644
index 0000000..cbccedf
--- /dev/null
+++ b/node_modules/csurf/node_modules/csrf/HISTORY.md
@@ -0,0 +1,86 @@
+3.0.3 / 2016-05-26
+==================
+
+  * deps: tsscmp@1.0.5
+
+3.0.2 / 2016-05-22
+==================
+
+  * Use `tsscmp` module for timing-safe token verification
+  * deps: base64-url@1.2.2
+  * deps: uid-safe@2.1.1
+    - deps: base64-url@1.2.2
+
+3.0.1 / 2016-01-28
+==================
+
+  * deps: rndm@1.2.0
+  * deps: uid-safe@2.1.0
+    - Use `random-bytes` for byte source
+
+3.0.0 / 2015-05-09
+==================
+
+  * Remove `tokenize` export
+  * Remove `tokenize` option
+  * Return a prototype-based object rather than functions
+    - This means the resulting functions need to be called as methods
+  * Throw when missing secret to `tokens.create()`
+  * deps: uid-safe@~2.0.0
+    - Use global `Promise` when returning a promise
+
+2.0.7 / 2015-05-03
+==================
+
+  * Fix compatibility with `crypto.DEFAULT_ENCODING` global changes
+
+2.0.6 / 2015-02-13
+==================
+
+  * deps: base64-url@1.2.1
+  * deps: uid-safe@~1.1.0
+    - Use `crypto.randomBytes`, if available
+    - deps: base64-url@1.2.1
+
+2.0.5 / 2015-01-31
+==================
+
+  * deps: base64-url@1.2.0
+  * deps: uid-safe@~1.0.3
+    - Fix error branch that would throw
+    - deps: base64-url@1.2.0
+
+2.0.4 / 2015-01-08
+==================
+
+  * deps: uid-safe@~1.0.2
+    - Remove dependency on `mz`
+
+2.0.3 / 2014-12-30
+==================
+
+  * Slight speed improvement for `verify`
+  * deps: base64-url@1.1.0
+  * deps: rndm@~1.1.0
+
+2.0.2 / 2014-11-09
+==================
+
+  * deps: scmp@1.0.0
+
+2.0.1 / 2014-08-22
+==================
+
+  * Rename module to `csrf`
+
+2.0.0 / 2014-06-18
+==================
+
+  * Use `uid-safe` module
+  * Use `base64-url` module
+  * Remove sync `.secret()` -- use `.secretSync()` instead
+
+1.0.4 / 2014-06-11
+==================
+
+  * Make sure CSRF tokens are URL safe
diff --git a/node_modules/csurf/node_modules/csrf/LICENSE b/node_modules/csurf/node_modules/csrf/LICENSE
new file mode 100644
index 0000000..6b774b4
--- /dev/null
+++ b/node_modules/csurf/node_modules/csrf/LICENSE
@@ -0,0 +1,22 @@
+The MIT License (MIT)
+
+Copyright (c) 2014 Jonathan Ong <me@jongleberry.com>
+Copyright (c) 2015 Douglas Christopher Wilson <doug@somethingdoug.com>
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
diff --git a/node_modules/csurf/node_modules/csrf/README.md b/node_modules/csurf/node_modules/csrf/README.md
new file mode 100644
index 0000000..537a02a
--- /dev/null
+++ b/node_modules/csurf/node_modules/csrf/README.md
@@ -0,0 +1,126 @@
+# CSRF
+
+[![NPM Version][npm-image]][npm-url]
+[![NPM Downloads][downloads-image]][downloads-url]
+[![Node.js Version][node-image]][node-url]
+[![Build Status][travis-image]][travis-url]
+[![Test Coverage][coveralls-image]][coveralls-url]
+
+Logic behind CSRF token creation and verification.
+
+Read [Understanding-CSRF](https://github.com/pillarjs/understanding-csrf)
+for more information on CSRF. Use this module to create custom CSRF middleware.
+
+Looking for a CSRF framework for your favorite framework that uses this
+module?
+
+  * Express/connect: [csurf](https://www.npmjs.com/package/csurf) or
+    [alt-xsrf](https://www.npmjs.com/package/alt-xsrf)
+  * Koa: [koa-csrf](https://www.npmjs.com/package/koa-csrf) or
+    [koa-atomic-session](https://www.npmjs.com/package/koa-atomic-session)
+
+### Install
+
+```bash
+$ npm install csrf
+```
+
+## API
+
+```js
+var Tokens = require('csrf')
+```
+
+### new Tokens([options])
+
+Create a new token generation/verification instance. The `options` argument is
+optional and will just use all defaults if missing.
+
+#### Options
+
+Tokens accepts these properties in the options object.
+
+##### saltLength
+
+The length of the internal salt to use, in characters. Internally, the salt
+is a base 62 string. Defaults to `8` characters.
+
+##### secretLength
+
+The length of the secret to generate, in bytes. Note that the secret is
+passed around base-64 encoded and that this length refers to the underlying
+bytes, not the length of the base-64 string. Defaults to `18` bytes.
+
+#### tokens.create(secret)
+
+Create a new CSRF token attached to the given `secret`. The `secret` is a
+string, typically generated from the `tokens.secret()` or `tokens.secretSync()`
+methods. This token is what you should add into HTML `<form>` blocks and
+expect the user's browser to provide back.
+
+```js
+var secret = tokens.secretSync()
+var token = tokens.create(secret)
+```
+
+#### tokens.secret(callback)
+
+Asynchronously create a new `secret`, which is a string. The secret is to
+be kept on the server, typically stored in a server-side session for the
+user. The secret should be at least per user.
+
+```js
+tokens.secret(function (err, secret) {
+  if (err) throw err
+  // do something with the secret
+})
+```
+
+#### tokens.secret()
+
+Asynchronously create a new `secret` and return a `Promise`. Please see
+`tokens.secret(callback)` documentation for full details.
+
+**Note**: To use promises in Node.js _prior to 0.12_, promises must be
+"polyfilled" using `global.Promise = require('bluebird')`.
+
+```js
+tokens.secret().then(function (secret) {
+  // do something with the secret
+})
+```
+
+#### tokens.secretSync()
+
+A synchronous version of `tokens.secret(callback)`. Please see
+`tokens.secret(callback)` documentation for full details.
+
+```js
+var secret = tokens.secretSync()
+```
+
+#### tokens.verify(secret, token)
+
+Check whether a CSRF token is valid for the given `secret`, returning
+a Boolean.
+
+```js
+if (!tokens.verify(secret, token)) {
+  throw new Error('invalid token!')
+}
+```
+
+## License
+
+[MIT](LICENSE)
+
+[npm-image]: https://img.shields.io/npm/v/csrf.svg
+[npm-url]: https://npmjs.org/package/csrf
+[node-image]: https://img.shields.io/node/v/csrf.svg
+[node-url]: https://nodejs.org/en/download/
+[travis-image]: https://img.shields.io/travis/pillarjs/csrf/master.svg
+[travis-url]: https://travis-ci.org/pillarjs/csrf
+[coveralls-image]: https://img.shields.io/coveralls/pillarjs/csrf/master.svg
+[coveralls-url]: https://coveralls.io/r/pillarjs/csrf?branch=master
+[downloads-image]: https://img.shields.io/npm/dm/csrf.svg
+[downloads-url]: https://npmjs.org/package/csrf
diff --git a/node_modules/csurf/node_modules/csrf/index.js b/node_modules/csurf/node_modules/csrf/index.js
new file mode 100644
index 0000000..9b252cd
--- /dev/null
+++ b/node_modules/csurf/node_modules/csrf/index.js
@@ -0,0 +1,139 @@
+/*!
+ * csrf
+ * Copyright(c) 2014 Jonathan Ong
+ * Copyright(c) 2015 Douglas Christopher Wilson
+ * MIT Licensed
+ */
+
+'use strict'
+
+/**
+ * Module dependencies.
+ * @private
+ */
+
+var rndm = require('rndm')
+var uid = require('uid-safe')
+var compare = require('tsscmp')
+var crypto = require('crypto')
+var escape = require('base64-url').escape
+
+/**
+ * Module exports.
+ * @public
+ */
+
+module.exports = Tokens
+
+/**
+ * Token generation/verification class.
+ *
+ * @param {object} [options]
+ * @param {number} [options.saltLength=8] The string length of the salt
+ * @param {number} [options.secretLength=18] The byte length of the secret key
+ * @public
+ */
+
+function Tokens (options) {
+  if (!(this instanceof Tokens)) {
+    return new Tokens(options)
+  }
+
+  var opts = options || {}
+
+  var saltLength = opts.saltLength !== undefined
+    ? opts.saltLength
+    : 8
+
+  if (typeof saltLength !== 'number' || !isFinite(saltLength) || saltLength < 1) {
+    throw new TypeError('option saltLength must be finite number > 1')
+  }
+
+  var secretLength = opts.secretLength !== undefined
+    ? opts.secretLength
+    : 18
+
+  if (typeof secretLength !== 'number' || !isFinite(secretLength) || secretLength < 1) {
+    throw new TypeError('option secretLength must be finite number > 1')
+  }
+
+  this.saltLength = saltLength
+  this.secretLength = secretLength
+}
+
+/**
+ * Create a new CSRF token.
+ *
+ * @param {string} secret The secret for the token.
+ * @public
+ */
+
+Tokens.prototype.create = function create (secret) {
+  if (!secret || typeof secret !== 'string') {
+    throw new TypeError('argument secret is required')
+  }
+
+  return this._tokenize(secret, rndm(this.saltLength))
+}
+
+/**
+ * Create a new secret key.
+ *
+ * @param {function} [callback]
+ * @public
+ */
+
+Tokens.prototype.secret = function secret (callback) {
+  return uid(this.secretLength, callback)
+}
+
+/**
+ * Create a new secret key synchronously.
+ * @public
+ */
+
+Tokens.prototype.secretSync = function secretSync () {
+  return uid.sync(this.secretLength)
+}
+
+/**
+ * Tokenize a secret and salt.
+ * @private
+ */
+
+Tokens.prototype._tokenize = function tokenize (secret, salt) {
+  var hash = crypto
+    .createHash('sha1')
+    .update(salt + '-' + secret, 'ascii')
+    .digest('base64')
+  return escape(salt + '-' + hash)
+}
+
+/**
+ * Verify if a given token is valid for a given secret.
+ *
+ * @param {string} secret
+ * @param {string} token
+ * @public
+ */
+
+Tokens.prototype.verify = function verify (secret, token) {
+  if (!secret || typeof secret !== 'string') {
+    return false
+  }
+
+  if (!token || typeof token !== 'string') {
+    return false
+  }
+
+  var index = token.indexOf('-')
+
+  if (index === -1) {
+    return false
+  }
+
+  var salt = token.substr(0, index)
+  var expected = this._tokenize(secret, salt)
+
+  return compare(token, expected)
+}
diff --git a/node_modules/csurf/node_modules/csrf/node_modules/base64-url/LICENSE b/node_modules/csurf/node_modules/csrf/node_modules/base64-url/LICENSE
new file mode 100644
index 0000000..9549143
--- /dev/null
+++ b/node_modules/csurf/node_modules/csrf/node_modules/base64-url/LICENSE
@@ -0,0 +1,15 @@
+The ISC License
+
+Copyright (c) 2014, Joaquim José F. Serafim
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
+IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
diff --git a/node_modules/csurf/node_modules/csrf/node_modules/base64-url/README.md b/node_modules/csurf/node_modules/csrf/node_modules/base64-url/README.md
new file mode 100644
index 0000000..d9368c8
--- /dev/null
+++ b/node_modules/csurf/node_modules/csrf/node_modules/base64-url/README.md
@@ -0,0 +1,55 @@
+# base64-url
+
+Base64 encode, decode, escape and unescape for URL applications.
+
+<a href="https://nodei.co/npm/base64-url/"><img src="https://nodei.co/npm/base64-url.png?downloads=true"></a>
+
+[![Build Status](https://travis-ci.org/joaquimserafim/base64-url.png?branch=master)](https://travis-ci.org/joaquimserafim/base64-url)
+
+
+## API
+
+```js
+base64url.encode('Node.js is awesome.');
+// returns Tm9kZS5qcyBpcyBhd2Vzb21lLg
+
+base64url.decode('Tm9kZS5qcyBpcyBhd2Vzb21lLg');
+// returns Node.js is awesome.
+
+base64url.escape('This+is/goingto+escape==');
+// returns This-is_goingto-escape
+
+base64url.unescape('This-is_goingto-escape');
+// returns This+is/goingto+escape==
+```
+
+
+## Development
+
+**this projet has been set up with a precommit that forces you to follow a code style, no jshint issues and 100% of code coverage before commit**
+
+
+to run test
+``` js
+npm test
+```
+
+to run jshint
+``` js
+npm run jshint
+```
+
+to run code style
+``` js
+npm run code-style
+```
+
+to check code coverage
+``` js
+npm run check-coverage
+```
+
+to open the code coverage report
+``` js
+npm run coverage
+```
diff --git a/node_modules/csurf/node_modules/csrf/node_modules/base64-url/index.js b/node_modules/csurf/node_modules/csrf/node_modules/base64-url/index.js
new file mode 100644
index 0000000..34968ae
--- /dev/null
+++ b/node_modules/csurf/node_modules/csrf/node_modules/base64-url/index.js
@@ -0,0 +1,24 @@
+'use strict';
+
+var base64url = module.exports;
+
+base64url.unescape = function unescape (str) {
+  return (str + Array(5 - str.length % 4)
+    .join('='))
+    .replace(/\-/g, '+')
+    .replace(/_/g, '/');
+};
+
+base64url.escape = function escape (str) {
+  return str.replace(/\+/g, '-')
+    .replace(/\//g, '_')
+    .replace(/=/g, '');
+};
+
+base64url.encode = function encode (str) {
+  return this.escape(new Buffer(str).toString('base64'));
+};
+
+base64url.decode = function decode (str) {
+  return new Buffer(this.unescape(str), 'base64').toString();
+};
diff --git a/node_modules/csurf/node_modules/csrf/node_modules/base64-url/package.json b/node_modules/csurf/node_modules/csrf/node_modules/base64-url/package.json
new file mode 100644
index 0000000..ab95386
--- /dev/null
+++ b/node_modules/csurf/node_modules/csrf/node_modules/base64-url/package.json
@@ -0,0 +1,75 @@
+{
+  "name": "base64-url",
+  "version": "1.2.2",
+  "description": "Base64 encode, decode, escape and unescape for URL applications",
+  "main": "index.js",
+  "files": [
+    "LICENSE",
+    "README.md",
+    "index.js"
+  ],
+  "scripts": {
+    "test": "istanbul cover tape test.js",
+    "jshint": "jshint -c .jshintrc *.js",
+    "code-style": "jscs -p google *.js",
+    "check-coverage": "istanbul check-coverage --statements 100 --functions 100 --lines 100 --branches 100",
+    "coverage": "open coverage/lcov-report/index.html"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git://github.com/joaquimserafim/base64-url.git"
+  },
+  "keywords": [
+    "base64",
+    "base64url"
+  ],
+  "author": {
+    "name": "@joaquimserafim"
+  },
+  "license": "ISC",
+  "bugs": {
+    "url": "https://github.com/joaquimserafim/base64-url/issues"
+  },
+  "homepage": "https://github.com/joaquimserafim/base64-url",
+  "devDependencies": {
+    "istanbul": "^0.3.5",
+    "jscs": "^1.9.0",
+    "jshint": "^2.5.11",
+    "pre-commit": "0.0.9",
+    "tape": "^3.0.3",
+    "which": "^1.0.8"
+  },
+  "pre-commit": [
+    "jshint",
+    "code-style",
+    "test",
+    "check-coverage"
+  ],
+  "gitHead": "7e5b7e351edbf67ed04e3475663d3a64e0c32035",
+  "_id": "base64-url@1.2.2",
+  "_shasum": "90af26ef8b0b67bc801b05eccf943345649008b3",
+  "_from": "base64-url@1.2.2",
+  "_npmVersion": "2.15.0",
+  "_nodeVersion": "4.4.2",
+  "_npmUser": {
+    "name": "quim",
+    "email": "joaquim.serafim@gmail.com"
+  },
+  "dist": {
+    "shasum": "90af26ef8b0b67bc801b05eccf943345649008b3",
+    "tarball": "https://registry.npmjs.org/base64-url/-/base64-url-1.2.2.tgz"
+  },
+  "maintainers": [
+    {
+      "name": "quim",
+      "email": "joaquim.serafim@gmail.com"
+    }
+  ],
+  "_npmOperationalInternal": {
+    "host": "packages-12-west.internal.npmjs.com",
+    "tmp": "tmp/base64-url-1.2.2.tgz_1459642531916_0.0884270598180592"
+  },
+  "directories": {},
+  "_resolved": "https://registry.npmjs.org/base64-url/-/base64-url-1.2.2.tgz",
+  "readme": "ERROR: No README data found!"
+}
diff --git a/node_modules/csurf/node_modules/csrf/node_modules/rndm/LICENSE b/node_modules/csurf/node_modules/csrf/node_modules/rndm/LICENSE
new file mode 100644
index 0000000..a7ae8ee
--- /dev/null
+++ b/node_modules/csurf/node_modules/csrf/node_modules/rndm/LICENSE
@@ -0,0 +1,22 @@
+
+The MIT License (MIT)
+
+Copyright (c) 2014 Jonathan Ong me@jongleberry.com
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
diff --git a/node_modules/csurf/node_modules/csrf/node_modules/rndm/README.md b/node_modules/csurf/node_modules/csrf/node_modules/rndm/README.md
new file mode 100644
index 0000000..504b1fd
--- /dev/null
+++ b/node_modules/csurf/node_modules/csrf/node_modules/rndm/README.md
@@ -0,0 +1,27 @@
+
+# RNDM
+
+Random string generator.
+Basically `Math.random().toString(36).slice(2)`,
+but with both upper and lower case letters and arbitrary lengths.
+Useful for creating fast, not cryptographically secure salts.
+
+## API
+
+```js
+// base62 by default
+var rndm = require('rndm')
+var salt = rndm(16)
+```
+
+### var salt = rndm(length)
+
+### var salt = rndm.base62(length)
+
+### var salt = rndm.base36(length)
+
+### var salt = rndm.base10(length)
+
+### var random = rndm.create(characters)
+
+Create a new random generator with custom characters.
diff --git a/node_modules/csurf/node_modules/csrf/node_modules/rndm/index.js b/node_modules/csurf/node_modules/csrf/node_modules/rndm/index.js
new file mode 100644
index 0000000..24b0ebb
--- /dev/null
+++ b/node_modules/csurf/node_modules/csrf/node_modules/rndm/index.js
@@ -0,0 +1,25 @@
+
+var assert = require('assert')
+
+var base62 = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789'
+var base36 = 'abcdefghijklmnopqrstuvwxyz0123456789'
+var base10 = '0123456789'
+
+exports = module.exports = create(base62)
+exports.base62 = exports
+exports.base36 = create(base36)
+exports.base10 = create(base10)
+
+exports.create = create
+
+function create(chars) {
+  assert(typeof chars === 'string', 'the list of characters must be a string!')
+  var length = Buffer.byteLength(chars)
+  return function rndm(len) {
+    len = len || 10
+    assert(typeof len === 'number' && len >= 0, 'the length of the random string must be a number!')
+    var salt = ''
+    for (var i = 0; i < len; i++) salt += chars[Math.floor(length * Math.random())]
+    return salt
+  }
+}
diff --git a/node_modules/csurf/node_modules/csrf/node_modules/rndm/package.json b/node_modules/csurf/node_modules/csrf/node_modules/rndm/package.json
new file mode 100644
index 0000000..2b06cd9
--- /dev/null
+++ b/node_modules/csurf/node_modules/csrf/node_modules/rndm/package.json
@@ -0,0 +1,72 @@
+{
+  "name": "rndm",
+  "description": "random string generator",
+  "version": "1.2.0",
+  "author": {
+    "name": "Jonathan Ong",
+    "email": "me@jongleberry.com",
+    "url": "http://jongleberry.com"
+  },
+  "license": "MIT",
+  "devDependencies": {
+    "mocha": "2",
+    "istanbul": "0"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/crypto-utils/rndm.git"
+  },
+  "scripts": {
+    "test": "mocha",
+    "test-cov": "istanbul cover node_modules/mocha/bin/_mocha -- --reporter dot",
+    "test-travis": "istanbul cover node_modules/mocha/bin/_mocha --report lcovonly -- --reporter dot"
+  },
+  "keywords": [
+    "random",
+    "number",
+    "generator",
+    "uid",
+    "id"
+  ],
+  "files": [
+    "index.js"
+  ],
+  "gitHead": "9d566c844a4c83487f3b2621be5b6588d5a2b617",
+  "bugs": {
+    "url": "https://github.com/crypto-utils/rndm/issues"
+  },
+  "homepage": "https://github.com/crypto-utils/rndm#readme",
+  "_id": "rndm@1.2.0",
+  "_shasum": "f33fe9cfb52bbfd520aa18323bc65db110a1b76c",
+  "_from": "rndm@1.2.0",
+  "_npmVersion": "2.14.4",
+  "_nodeVersion": "4.1.1",
+  "_npmUser": {
+    "name": "coderhaoxin",
+    "email": "coderhaoxin@outlook.com"
+  },
+  "maintainers": [
+    {
+      "name": "coderhaoxin",
+      "email": "coderhaoxin@outlook.com"
+    },
+    {
+      "name": "dougwilson",
+      "email": "doug@somethingdoug.com"
+    },
+    {
+      "name": "fishrock123",
+      "email": "fishrock123@rocketmail.com"
+    },
+    {
+      "name": "jongleberry",
+      "email": "jonathanrichardong@gmail.com"
+    }
+  ],
+  "dist": {
+    "shasum": "f33fe9cfb52bbfd520aa18323bc65db110a1b76c",
+    "tarball": "https://registry.npmjs.org/rndm/-/rndm-1.2.0.tgz"
+  },
+  "directories": {},
+  "_resolved": "https://registry.npmjs.org/rndm/-/rndm-1.2.0.tgz"
+}
diff --git a/node_modules/csurf/node_modules/csrf/node_modules/tsscmp/.npmignore b/node_modules/csurf/node_modules/csrf/node_modules/tsscmp/.npmignore
new file mode 100644
index 0000000..c2658d7
--- /dev/null
+++ b/node_modules/csurf/node_modules/csrf/node_modules/tsscmp/.npmignore
@@ -0,0 +1 @@
+node_modules/
diff --git a/node_modules/csurf/node_modules/csrf/node_modules/tsscmp/.travis.yml b/node_modules/csurf/node_modules/csrf/node_modules/tsscmp/.travis.yml
new file mode 100644
index 0000000..b85d89f
--- /dev/null
+++ b/node_modules/csurf/node_modules/csrf/node_modules/tsscmp/.travis.yml
@@ -0,0 +1,14 @@
+language: node_js
+node_js:
+  - "6"
+  - "5"
+  - "5.1"
+  - "4"
+  - "4.2"
+  - "4.1"
+  - "4.0"
+  - "0.12"
+  - "0.11"
+  - "0.10"
+  - "0.8"
+  - "0.6"
diff --git a/node_modules/csurf/node_modules/csrf/node_modules/tsscmp/LICENSE b/node_modules/csurf/node_modules/csrf/node_modules/tsscmp/LICENSE
new file mode 100644
index 0000000..c62e51b
--- /dev/null
+++ b/node_modules/csurf/node_modules/csrf/node_modules/tsscmp/LICENSE
@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2016
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
diff --git a/node_modules/csurf/node_modules/csrf/node_modules/tsscmp/README.md b/node_modules/csurf/node_modules/csrf/node_modules/tsscmp/README.md
new file mode 100644
index 0000000..cba99d0
--- /dev/null
+++ b/node_modules/csurf/node_modules/csrf/node_modules/tsscmp/README.md
@@ -0,0 +1,48 @@
+# Timing safe string compare using double HMAC
+
+[![Node.js Version](https://img.shields.io/node/v/tsscmp.svg?style=flat-square)](https://nodejs.org/en/download)
+[![npm](https://img.shields.io/npm/v/tsscmp.svg?style=flat-square)](https://npmjs.org/package/tsscmp)
+[![NPM Downloads](https://img.shields.io/npm/dm/tsscmp.svg?style=flat-square)](https://npmjs.org/package/tsscmp)
+[![Build Status](https://img.shields.io/travis/suryagh/tsscmp/master.svg?style=flat-square)](https://travis-ci.org/suryagh/tsscmp)
+[![Build Status](https://img.shields.io/appveyor/ci/suryagh/tsscmp/master.svg?style=flat-square&label=windows)](https://ci.appveyor.com/project/suryagh/tsscmp)
+[![Dependency Status](http://img.shields.io/david/suryagh/tsscmp.svg?style=flat-square)](https://david-dm.org/suryagh/tsscmp)
+[![npm-license](http://img.shields.io/npm/l/tsscmp.svg?style=flat-square)](LICENSE)
+
+
+Prevents [timing attacks](http://codahale.com/a-lesson-in-timing-attacks/) using Brad Hill's
+[Double HMAC pattern](https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2011/february/double-hmac-verification/)
+to perform secure string comparison. Double HMAC avoids the timing atacks by blinding the
+timing channel using random time per attempt comparison against iterative brute force attacks.
+
+
+## Install
+
+```
+npm install tsscmp
+```
+## Why
+To compare secret values like **authentication tokens**, **passwords** or
+**capability urls** so that timing information is not
+leaked to the attacker.
+
+## Example
+
+```js
+var timingSafeCompare = require('tsscmp');
+
+var sessionToken = '127e6fbfe24a750e72930c';
+var givenToken = '127e6fbfe24a750e72930c';
+
+if (timingSafeCompare(sessionToken, givenToken)) {
+  console.log('good token');
+} else {
+  console.log('bad token');
+}
+```
+##License: 
+[MIT](LICENSE)
+
+**Credits to:**  [@jsha](https://github.com/jsha) |
+[@bnoordhuis](https://github.com/bnoordhuis) |
+[@suryagh](https://github.com/suryagh) |
+ 
\ No newline at end of file
diff --git a/node_modules/csurf/node_modules/csrf/node_modules/tsscmp/appveyor.yml b/node_modules/csurf/node_modules/csrf/node_modules/tsscmp/appveyor.yml
new file mode 100644
index 0000000..29cd460
--- /dev/null
+++ b/node_modules/csurf/node_modules/csrf/node_modules/tsscmp/appveyor.yml
@@ -0,0 +1,29 @@
+# Test against this version of Node.js
+environment:
+  matrix:
+   # nodejs_version: "0.6" not supported  in Windows x86
+   - nodejs_version: "0.8"
+   - nodejs_version: "0.10"
+   - nodejs_version: "0.11"
+   - nodejs_version: "0.12"
+   - nodejs_version: "4.0"
+   - nodejs_version: "5.0"
+   - nodejs_version: "6.0"
+
+# Install scripts. (runs after repo cloning)
+install:
+  # Get the latest stable version of Node.js or io.js
+  - ps: Install-Product node $env:nodejs_version
+  # install modules
+  - npm install
+
+# Post-install test scripts.
+test_script:
+  # Output useful info for debugging.
+  - node --version
+  - npm --version
+  # run tests
+  - npm test
+
+# Don't actually build.
+build: off
diff --git a/node_modules/csurf/node_modules/csrf/node_modules/tsscmp/lib/index.js b/node_modules/csurf/node_modules/csrf/node_modules/tsscmp/lib/index.js
new file mode 100644
index 0000000..7c86142
--- /dev/null
+++ b/node_modules/csurf/node_modules/csrf/node_modules/tsscmp/lib/index.js
@@ -0,0 +1,33 @@
+'use strict';
+
+// Implements Brad Hill's Double HMAC pattern from
+// https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2011/february/double-hmac-verification/.
+// The approach is similar to the node's native implementation of timing safe buffer comparison that will be available on v6+.
+// https://github.com/nodejs/node/issues/3043
+// https://github.com/nodejs/node/pull/3073
+
+var crypto = require('crypto');
+
+function bufferEqual(a, b) {
+  if (a.length !== b.length) {
+    return false;
+  }
+  for (var i = 0; i < a.length; i++) {
+    if (a[i] !== b[i]) {
+      return false;
+    }
+  }
+  return true;
+}
+
+function timeSafeCompare(a, b) {
+  var sa = String(a);
+  var sb = String(b);
+  var key = crypto.pseudoRandomBytes(32);
+  var ah = crypto.createHmac('sha256', key).update(sa).digest();
+  var bh = crypto.createHmac('sha256', key).update(sb).digest();
+
+  return bufferEqual(ah, bh) && a === b;
+}
+
+module.exports = timeSafeCompare;
diff --git a/node_modules/csurf/node_modules/csrf/node_modules/tsscmp/package.json b/node_modules/csurf/node_modules/csrf/node_modules/tsscmp/package.json
new file mode 100644
index 0000000..26051ae
--- /dev/null
+++ b/node_modules/csurf/node_modules/csrf/node_modules/tsscmp/package.json
@@ -0,0 +1,61 @@
+{
+  "name": "tsscmp",
+  "version": "1.0.5",
+  "description": "Timing safe string compare using double HMAC",
+  "main": "lib/index.js",
+  "dependencies": {},
+  "devDependencies": {},
+  "scripts": {
+    "test": "node test/unit && node test/benchmark"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/suryagh/tsscmp.git"
+  },
+  "keywords": [
+    "timing safe string compare",
+    "double hmac string compare",
+    "safe string compare",
+    "hmac"
+  ],
+  "author": {
+    "name": "suryagh"
+  },
+  "publishConfig": {
+    "registry": "https://registry.npmjs.org"
+  },
+  "engines": {
+    "node": ">=0.6.x"
+  },
+  "license": "MIT",
+  "gitHead": "095fb02b3e6102cbd1d2bdc9613e3da54e782f59",
+  "bugs": {
+    "url": "https://github.com/suryagh/tsscmp/issues"
+  },
+  "homepage": "https://github.com/suryagh/tsscmp#readme",
+  "_id": "tsscmp@1.0.5",
+  "_shasum": "7dc4a33af71581ab4337da91d85ca5427ebd9a97",
+  "_from": "tsscmp@1.0.5",
+  "_npmVersion": "3.6.0",
+  "_nodeVersion": "5.6.0",
+  "_npmUser": {
+    "name": "suryagh",
+    "email": "surya.com@gmail.com"
+  },
+  "dist": {
+    "shasum": "7dc4a33af71581ab4337da91d85ca5427ebd9a97",
+    "tarball": "https://registry.npmjs.org/tsscmp/-/tsscmp-1.0.5.tgz"
+  },
+  "maintainers": [
+    {
+      "name": "suryagh",
+      "email": "surya.com@gmail.com"
+    }
+  ],
+  "_npmOperationalInternal": {
+    "host": "packages-16-east.internal.npmjs.com",
+    "tmp": "tmp/tsscmp-1.0.5.tgz_1464226502956_0.48576042777858675"
+  },
+  "directories": {},
+  "_resolved": "https://registry.npmjs.org/tsscmp/-/tsscmp-1.0.5.tgz"
+}
diff --git a/node_modules/csurf/node_modules/csrf/node_modules/tsscmp/test/benchmark/index.js b/node_modules/csurf/node_modules/csrf/node_modules/tsscmp/test/benchmark/index.js
new file mode 100644
index 0000000..fd93e42
--- /dev/null
+++ b/node_modules/csurf/node_modules/csrf/node_modules/tsscmp/test/benchmark/index.js
@@ -0,0 +1,30 @@
+'use strict';
+
+var timeSafeCompare = require('../../lib/index');
+
+function random(length) {
+
+    length = length || 32;
+    var result = "";
+    var possible = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789!@#$%^&*()-+/*[]{}-=\|;\':\"<>?,./";
+
+    for( var i=0; i < length; i++ ){
+        result += possible.charAt(Math.floor(Math.random() * possible.length));
+    }
+    return result;
+}
+
+function run(count) {
+    count = count || 100*1000;
+    console.log('benchmark count: ' + count/1000 + 'k');
+    console.time('benchmark');
+    
+    while(count--){
+        timeSafeCompare(random(), random());
+    }
+    console.timeEnd('benchmark');
+}
+
+run(100000);
+
+module.exports = run;
diff --git a/node_modules/csurf/node_modules/csrf/node_modules/tsscmp/test/unit/index.js b/node_modules/csurf/node_modules/csrf/node_modules/tsscmp/test/unit/index.js
new file mode 100644
index 0000000..0335423
--- /dev/null
+++ b/node_modules/csurf/node_modules/csrf/node_modules/tsscmp/test/unit/index.js
@@ -0,0 +1,69 @@
+'use strict';
+
+var assert = require('assert');
+var timeSafeCompare = require('../../lib/index');
+
+process.on('error', function (e) {
+	console.log('caught: ' + e);
+});
+
+function testEqual(a, b) {
+	assert(timeSafeCompare(a, b));
+
+	// lets also do a parity check with the strict equal to operator
+	assert(a === b);
+}
+
+function testNotEqual(a, b) {
+	assert(!timeSafeCompare(a, b));
+
+	// lets also do a parity check with the strict not equal to operator
+	assert(a !== b);
+}
+
+// note: lets also make sure tsscmp can be inline replaced for any types -
+// just incase if anyone is interested
+
+// positive tests
+testEqual('127e6fbfe24a750e72930c220a8e138275656b8e5d8f48a98c3c92df2caba935',
+	'127e6fbfe24a750e72930c220a8e138275656b8e5d8f48a98c3c92df2caba935',
+	'test ');
+testEqual('a', 'a');
+testEqual('', '');
+testEqual(undefined, undefined);
+testEqual(true, true);
+testEqual(false, false);
+(function () {
+	var a = { a: 1 };
+	testEqual(a, a);
+})();
+(function () {
+	function f1() { return 1; };
+	testEqual(f1, f1);
+})();
+
+// negative tests
+testNotEqual('');
+testNotEqual('a', 'b');
+testNotEqual('a', 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa');
+testNotEqual('aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa', 'a');
+testNotEqual('alpha', 'beta');
+testNotEqual(false, true);
+testNotEqual(false, undefined);
+testNotEqual(function () { }, function () { });
+testNotEqual({}, {});
+testNotEqual({ a: 1 }, { a: 1 });
+testNotEqual({ a: 1 }, { a: 2 });
+testNotEqual([1, 2], [1, 2]);
+testNotEqual([1, 2], [1, 2, 3]);
+(function () {
+	var a = { p: 1 };
+	var b = { p: 1 };
+	testNotEqual(a, b);
+})();
+(function () {
+	function f1() { return 1; };
+	function f2() { return 1; };
+	testNotEqual(f1, f2);
+})();
+console.log('Success: all tests complete.');
diff --git a/node_modules/csurf/node_modules/csrf/node_modules/uid-safe/HISTORY.md b/node_modules/csurf/node_modules/csrf/node_modules/uid-safe/HISTORY.md
new file mode 100644
index 0000000..365c92f
--- /dev/null
+++ b/node_modules/csurf/node_modules/csrf/node_modules/uid-safe/HISTORY.md
@@ -0,0 +1,41 @@
+2.1.1 / 2016-05-04
+==================
+
+  * deps: base64-url@1.2.2
+
+2.1.0 / 2016-01-17
+==================
+
+  * Use `random-bytes` for byte source
+
+2.0.0 / 2015-05-08
+==================
+
+  * Use global `Promise` when returning a promise
+
+1.1.0 / 2015-02-01
+==================
+
+  * Use `crypto.randomBytes`, if available
+  * deps: base64-url@1.2.1
+
+1.0.3 / 2015-01-31
+==================
+
+  * Fix error branch that would throw
+  * deps: base64-url@1.2.0
+
+1.0.2 / 2015-01-08
+==================
+
+  * Remove dependency on `mz`
+
+1.0.1 / 2014-06-18
+==================
+
+  * Remove direct `bluebird` dependency
+
+1.0.0 / 2014-06-18
+==================
+
+  * Initial release
diff --git a/node_modules/csurf/node_modules/csrf/node_modules/uid-safe/LICENSE b/node_modules/csurf/node_modules/csrf/node_modules/uid-safe/LICENSE
new file mode 100644
index 0000000..7a7a4e1
--- /dev/null
+++ b/node_modules/csurf/node_modules/csrf/node_modules/uid-safe/LICENSE
@@ -0,0 +1,22 @@
+The MIT License (MIT)
+
+Copyright (c) 2014 Jonathan Ong <me@jongleberry.com>
+Copyright (c) 2015-2016 Douglas Christopher Wilson <doug@somethingdoug.com>
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
diff --git a/node_modules/csurf/node_modules/csrf/node_modules/uid-safe/README.md b/node_modules/csurf/node_modules/csrf/node_modules/uid-safe/README.md
new file mode 100644
index 0000000..fa02be8
--- /dev/null
+++ b/node_modules/csurf/node_modules/csrf/node_modules/uid-safe/README.md
@@ -0,0 +1,77 @@
+# uid-safe
+
+[![NPM Version][npm-image]][npm-url]
+[![NPM Downloads][downloads-image]][downloads-url]
+[![Node.js Version][node-version-image]][node-version-url]
+[![Build Status][travis-image]][travis-url]
+[![Test Coverage][coveralls-image]][coveralls-url]
+
+URL and cookie safe UIDs
+
+Create cryptographically secure UIDs safe for both cookie and URL usage.
+This is in contrast to modules such as [rand-token](https://www.npmjs.com/package/rand-token)
+and [uid2](https://www.npmjs.com/package/uid2) whose UIDs are actually skewed
+due to the use of `%` and unnecessarily truncate the UID.
+Use this if you could still use UIDs with `-` and `_` in them.
+
+## Installation
+
+```sh
+$ npm install uid-safe
+```
+
+## API
+
+```js
+var uid = require('uid-safe')
+```
+
+### uid(byteLength, callback)
+
+Asynchronously create a UID with a specific byte length. Because `base64`
+encoding is used underneath, this is not the string length. For example,
+to create a UID of length 24, you want a byte length of 18.
+
+```js
+uid(18, function (err, string) {
+  if (err) throw err
+  // do something with the string
+})
+```
+
+### uid(byteLength)
+
+Asynchronously create a UID with a specific byte length and return a
+`Promise`.
+
+**Note**: To use promises in Node.js _prior to 0.12_, promises must be
+"polyfilled" using `global.Promise = require('bluebird')`.
+
+```js
+uid(18).then(function (string) {
+  // do something with the string
+})
+```
+
+### uid.sync(byteLength)
+
+A synchronous version of above.
+
+```js
+var string = uid.sync(18)
+```
+
+## License
+
+[MIT](LICENSE)
+
+[npm-image]: https://img.shields.io/npm/v/uid-safe.svg
+[npm-url]: https://npmjs.org/package/uid-safe
+[node-version-image]: https://img.shields.io/node/v/uid-safe.svg
+[node-version-url]: https://nodejs.org/en/download/
+[travis-image]: https://img.shields.io/travis/crypto-utils/uid-safe/master.svg
+[travis-url]: https://travis-ci.org/crypto-utils/uid-safe
+[coveralls-image]: https://img.shields.io/coveralls/crypto-utils/uid-safe/master.svg
+[coveralls-url]: https://coveralls.io/r/crypto-utils/uid-safe?branch=master
+[downloads-image]: https://img.shields.io/npm/dm/uid-safe.svg
+[downloads-url]: https://npmjs.org/package/uid-safe
diff --git a/node_modules/csurf/node_modules/csrf/node_modules/uid-safe/index.js b/node_modules/csurf/node_modules/csrf/node_modules/uid-safe/index.js
new file mode 100644
index 0000000..9bef704
--- /dev/null
+++ b/node_modules/csurf/node_modules/csrf/node_modules/uid-safe/index.js
@@ -0,0 +1,96 @@
+/*!
+ * uid-safe
+ * Copyright(c) 2014 Jonathan Ong
+ * Copyright(c) 2015-2016 Douglas Christopher Wilson
+ * MIT Licensed
+ */
+
+'use strict'
+
+/**
+ * Module dependencies.
+ * @private
+ */
+
+var escape = require('base64-url').escape
+var randomBytes = require('random-bytes')
+
+/**
+ * Module exports.
+ * @public
+ */
+
+module.exports = uid
+module.exports.sync = uidSync
+
+/**
+ * Create a unique ID.
+ *
+ * @param {number} length
+ * @param {function} [callback]
+ * @return {Promise}
+ * @public
+ */
+
+function uid(length, callback) {
+  // validate callback is a function, if provided
+  if (callback !== undefined && typeof callback !== 'function') {
+    throw new TypeError('argument callback must be a function')
+  }
+
+  // require the callback without promises
+  if (!callback && !global.Promise) {
+    throw new TypeError('argument callback is required')
+  }
+
+  if (callback) {
+    // classic callback style
+    return generateUid(length, callback)
+  }
+
+  return new Promise(function executor(resolve, reject) {
+    generateUid(length, function onUid(err, str) {
+      if (err) return reject(err)
+      resolve(str)
+    })
+  })
+}
+
+/**
+ * Create a unique ID sync.
+ *
+ * @param {number} length
+ * @return {string}
+ * @public
+ */
+
+function uidSync(length) {
+  return toString(randomBytes.sync(length))
+}
+
+/**
+ * Generate a unique ID string.
+ *
+ * @param {number} length
+ * @param {function} callback
+ * @private
+ */
+
+function generateUid(length, callback) {
+  randomBytes(length, function (err, buf) {
+    if (err) return callback(err)
+    callback(null, toString(buf))
+  })
+}
+
+/**
+ * Change a Buffer into a string.
+ *
+ * @param {Buffer} buf
+ * @return {string}
+ * @private
+ */
+
+function toString(buf) {
+  return escape(buf.toString('base64'))
+}
diff --git a/node_modules/csurf/node_modules/csrf/node_modules/uid-safe/node_modules/random-bytes/HISTORY.md b/node_modules/csurf/node_modules/csrf/node_modules/uid-safe/node_modules/random-bytes/HISTORY.md
new file mode 100644
index 0000000..8cabd9d
--- /dev/null
+++ b/node_modules/csurf/node_modules/csrf/node_modules/uid-safe/node_modules/random-bytes/HISTORY.md
@@ -0,0 +1,4 @@
+1.0.0 / 2016-01-17
+==================
+
+  * Initial release
diff --git a/node_modules/csurf/node_modules/csrf/node_modules/uid-safe/node_modules/random-bytes/LICENSE b/node_modules/csurf/node_modules/csrf/node_modules/uid-safe/node_modules/random-bytes/LICENSE
new file mode 100644
index 0000000..c24dbe3
--- /dev/null
+++ b/node_modules/csurf/node_modules/csrf/node_modules/uid-safe/node_modules/random-bytes/LICENSE
@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2016 Douglas Christopher Wilson <doug@somethingdoug.com>
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
diff --git a/node_modules/csurf/node_modules/csrf/node_modules/uid-safe/node_modules/random-bytes/README.md b/node_modules/csurf/node_modules/csrf/node_modules/uid-safe/node_modules/random-bytes/README.md
new file mode 100644
index 0000000..df5aacc
--- /dev/null
+++ b/node_modules/csurf/node_modules/csrf/node_modules/uid-safe/node_modules/random-bytes/README.md
@@ -0,0 +1,77 @@
+# random-bytes
+
+[![NPM Version][npm-image]][npm-url]
+[![NPM Downloads][downloads-image]][downloads-url]
+[![Node.js Version][node-version-image]][node-version-url]
+[![Build Status][travis-image]][travis-url]
+[![Test Coverage][coveralls-image]][coveralls-url]
+
+Generate strong pseudo-random bytes.
+
+This module is a simple wrapper around the Node.js core `crypto.randomBytes` API,
+with the following additions:
+
+  * A `Promise` interface for environments with promises.
+  * For Node.js versions that do not wait for the PRNG to be seeded, this module
+    will wait a bit.
+
+## Installation
+
+```sh
+$ npm install random-bytes
+```
+
+## API
+
+```js
+var randomBytes = require('random-bytes')
+```
+
+### randomBytes(size, callback)
+
+Generates strong pseudo-random bytes. The `size` argument is a number indicating
+the number of bytes to generate.
+
+```js
+randomBytes(12, function (error, bytes) {
+  if (error) throw error
+  // do something with the bytes
+})
+```
+
+### randomBytes(size)
+
+Generates strong pseudo-random bytes and return a `Promise`. The `size` argument is
+a number indicating the number of bytes to generate.
+
+**Note**: To use promises in Node.js _prior to 0.12_, promises must be
+"polyfilled" using `global.Promise = require('bluebird')`.
+
+```js
+randomBytes(18).then(function (string) {
+  // do something with the string
+})
+```
+
+### randomBytes.sync(size)
+
+A synchronous version of above.
+
+```js
+var bytes = randomBytes.sync(18)
+```
+
+## License
+
+[MIT](LICENSE)
+
+[npm-image]: https://img.shields.io/npm/v/random-bytes.svg
+[npm-url]: https://npmjs.org/package/random-bytes
+[node-version-image]: https://img.shields.io/node/v/random-bytes.svg
+[node-version-url]: http://nodejs.org/download/
+[travis-image]: https://img.shields.io/travis/crypto-utils/random-bytes/master.svg
+[travis-url]: https://travis-ci.org/crypto-utils/random-bytes
+[coveralls-image]: https://img.shields.io/coveralls/crypto-utils/random-bytes/master.svg
+[coveralls-url]: https://coveralls.io/r/crypto-utils/random-bytes?branch=master
+[downloads-image]: https://img.shields.io/npm/dm/random-bytes.svg
+[downloads-url]: https://npmjs.org/package/random-bytes
diff --git a/node_modules/csurf/node_modules/csrf/node_modules/uid-safe/node_modules/random-bytes/index.js b/node_modules/csurf/node_modules/csrf/node_modules/uid-safe/node_modules/random-bytes/index.js
new file mode 100644
index 0000000..9ad930f
--- /dev/null
+++ b/node_modules/csurf/node_modules/csrf/node_modules/uid-safe/node_modules/random-bytes/index.js
@@ -0,0 +1,101 @@
+/*!
+ * random-bytes
+ * Copyright(c) 2016 Douglas Christopher Wilson
+ * MIT Licensed
+ */
+
+'use strict'
+
+/**
+ * Module dependencies.
+ * @private
+ */
+
+var crypto = require('crypto')
+
+/**
+ * Module variables.
+ * @private
+ */
+
+var generateAttempts = crypto.randomBytes === crypto.pseudoRandomBytes ? 1 : 3
+
+/**
+ * Module exports.
+ * @public
+ */
+
+module.exports = randomBytes
+module.exports.sync = randomBytesSync
+
+/**
+ * Generates strong pseudo-random bytes.
+ *
+ * @param {number} size
+ * @param {function} [callback]
+ * @return {Promise}
+ * @public
+ */
+
+function randomBytes(size, callback) {
+  // validate callback is a function, if provided
+  if (callback !== undefined && typeof callback !== 'function') {
+    throw new TypeError('argument callback must be a function')
+  }
+
+  // require the callback without promises
+  if (!callback && !global.Promise) {
+    throw new TypeError('argument callback is required')
+  }
+
+  if (callback) {
+    // classic callback style
+    return generateRandomBytes(size, generateAttempts, callback)
+  }
+
+  return new Promise(function executor(resolve, reject) {
+    generateRandomBytes(size, generateAttempts, function onRandomBytes(err, str) {
+      if (err) return reject(err)
+      resolve(str)
+    })
+  })
+}
+
+/**
+ * Generates strong pseudo-random bytes sync.
+ *
+ * @param {number} size
+ * @return {Buffer}
+ * @public
+ */
+
+function randomBytesSync(size) {
+  var err = null
+
+  for (var i = 0; i < generateAttempts; i++) {
+    try {
+      return crypto.randomBytes(size)
+    } catch (e) {
+      err = e
+    }
+  }
+
+  throw err
+}
+
+/**
+ * Generates strong pseudo-random bytes.
+ *
+ * @param {number} size
+ * @param {number} attempts
+ * @param {function} callback
+ * @private
+ */
+
+function generateRandomBytes(size, attempts, callback) {
+  crypto.randomBytes(size, function onRandomBytes(err, buf) {
+    if (!err) return callback(null, buf)
+    if (!--attempts) return callback(err)
+    setTimeout(generateRandomBytes.bind(null, size, attempts, callback), 10)
+  })
+}
diff --git a/node_modules/csurf/node_modules/csrf/node_modules/uid-safe/node_modules/random-bytes/package.json b/node_modules/csurf/node_modules/csrf/node_modules/uid-safe/node_modules/random-bytes/package.json
new file mode 100644
index 0000000..8f56cba
--- /dev/null
+++ b/node_modules/csurf/node_modules/csrf/node_modules/uid-safe/node_modules/random-bytes/package.json
@@ -0,0 +1,68 @@
+{
+  "name": "random-bytes",
+  "description": "URL and cookie safe UIDs",
+  "version": "1.0.0",
+  "contributors": [
+    {
+      "name": "Douglas Christopher Wilson",
+      "email": "doug@somethingdoug.com"
+    }
+  ],
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/crypto-utils/random-bytes.git"
+  },
+  "devDependencies": {
+    "bluebird": "3.1.1",
+    "istanbul": "0.4.2",
+    "mocha": "2.3.4",
+    "proxyquire": "1.2.0"
+  },
+  "files": [
+    "LICENSE",
+    "HISTORY.md",
+    "README.md",
+    "index.js"
+  ],
+  "engines": {
+    "node": ">= 0.8"
+  },
+  "scripts": {
+    "test": "mocha --trace-deprecation --reporter spec --bail --check-leaks test/",
+    "test-cov": "istanbul cover node_modules/mocha/bin/_mocha -- --trace-deprecation --reporter dot --check-leaks test/",
+    "test-travis": "istanbul cover node_modules/mocha/bin/_mocha --report lcovonly -- --trace-deprecation --reporter spec --check-leaks test/"
+  },
+  "keywords": [
+    "bytes",
+    "generator",
+    "random",
+    "safe"
+  ],
+  "gitHead": "3dcd47425a3dfe858ee8debcd4db0c1222110bc3",
+  "bugs": {
+    "url": "https://github.com/crypto-utils/random-bytes/issues"
+  },
+  "homepage": "https://github.com/crypto-utils/random-bytes",
+  "_id": "random-bytes@1.0.0",
+  "_shasum": "4f68a1dc0ae58bd3fb95848c30324db75d64360b",
+  "_from": "random-bytes@>=1.0.0 <1.1.0",
+  "_npmVersion": "1.4.28",
+  "_npmUser": {
+    "name": "dougwilson",
+    "email": "doug@somethingdoug.com"
+  },
+  "maintainers": [
+    {
+      "name": "dougwilson",
+      "email": "doug@somethingdoug.com"
+    }
+  ],
+  "dist": {
+    "shasum": "4f68a1dc0ae58bd3fb95848c30324db75d64360b",
+    "tarball": "https://registry.npmjs.org/random-bytes/-/random-bytes-1.0.0.tgz"
+  },
+  "directories": {},
+  "_resolved": "https://registry.npmjs.org/random-bytes/-/random-bytes-1.0.0.tgz",
+  "readme": "ERROR: No README data found!"
+}
diff --git a/node_modules/csurf/node_modules/csrf/node_modules/uid-safe/package.json b/node_modules/csurf/node_modules/csrf/node_modules/uid-safe/package.json
new file mode 100644
index 0000000..295b4a9
--- /dev/null
+++ b/node_modules/csurf/node_modules/csrf/node_modules/uid-safe/package.json
@@ -0,0 +1,89 @@
+{
+  "name": "uid-safe",
+  "description": "URL and cookie safe UIDs",
+  "version": "2.1.1",
+  "contributors": [
+    {
+      "name": "Douglas Christopher Wilson",
+      "email": "doug@somethingdoug.com"
+    },
+    {
+      "name": "Jonathan Ong",
+      "email": "me@jongleberry.com",
+      "url": "http://jongleberry.com"
+    }
+  ],
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/crypto-utils/uid-safe.git"
+  },
+  "dependencies": {
+    "base64-url": "1.2.2",
+    "random-bytes": "~1.0.0"
+  },
+  "devDependencies": {
+    "bluebird": "3.3.5",
+    "istanbul": "0.4.3",
+    "mocha": "2.4.5"
+  },
+  "files": [
+    "LICENSE",
+    "HISTORY.md",
+    "README.md",
+    "index.js"
+  ],
+  "engines": {
+    "node": ">= 0.8"
+  },
+  "scripts": {
+    "test": "mocha --trace-deprecation --reporter spec --bail --check-leaks test/",
+    "test-cov": "istanbul cover node_modules/mocha/bin/_mocha -- --trace-deprecation --reporter dot --check-leaks test/",
+    "test-travis": "istanbul cover node_modules/mocha/bin/_mocha --report lcovonly -- --trace-deprecation --reporter spec --check-leaks test/"
+  },
+  "keywords": [
+    "random",
+    "generator",
+    "uid",
+    "safe"
+  ],
+  "gitHead": "5cb17ae9451505ac823877e641a6f080731822ea",
+  "bugs": {
+    "url": "https://github.com/crypto-utils/uid-safe/issues"
+  },
+  "homepage": "https://github.com/crypto-utils/uid-safe#readme",
+  "_id": "uid-safe@2.1.1",
+  "_shasum": "3dbf9436b528be9f52882c05a6216c3763db3666",
+  "_from": "uid-safe@2.1.1",
+  "_npmVersion": "2.15.1",
+  "_nodeVersion": "4.4.3",
+  "_npmUser": {
+    "name": "dougwilson",
+    "email": "doug@somethingdoug.com"
+  },
+  "dist": {
+    "shasum": "3dbf9436b528be9f52882c05a6216c3763db3666",
+    "tarball": "https://registry.npmjs.org/uid-safe/-/uid-safe-2.1.1.tgz"
+  },
+  "maintainers": [
+    {
+      "name": "dougwilson",
+      "email": "doug@somethingdoug.com"
+    },
+    {
+      "name": "fishrock123",
+      "email": "fishrock123@rocketmail.com"
+    },
+    {
+      "name": "jongleberry",
+      "email": "jonathanrichardong@gmail.com"
+    }
+  ],
+  "_npmOperationalInternal": {
+    "host": "packages-12-west.internal.npmjs.com",
+    "tmp": "tmp/uid-safe-2.1.1.tgz_1462417218771_0.08699076832272112"
+  },
+  "directories": {},
+  "_resolved": "https://registry.npmjs.org/uid-safe/-/uid-safe-2.1.1.tgz",
+  "readme": "ERROR: No README data found!"
+}
diff --git a/node_modules/csurf/node_modules/csrf/package.json b/node_modules/csurf/node_modules/csrf/package.json
new file mode 100644
index 0000000..d61e50c
--- /dev/null
+++ b/node_modules/csurf/node_modules/csrf/package.json
@@ -0,0 +1,92 @@
+{
+  "name": "csrf",
+  "description": "primary logic behind csrf tokens",
+  "version": "3.0.3",
+  "author": {
+    "name": "Jonathan Ong",
+    "email": "me@jongleberry.com",
+    "url": "http://jongleberry.com"
+  },
+  "contributors": [
+    {
+      "name": "Douglas Christopher Wilson",
+      "email": "doug@somethingdoug.com"
+    }
+  ],
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/pillarjs/csrf"
+  },
+  "dependencies": {
+    "base64-url": "1.2.2",
+    "rndm": "1.2.0",
+    "tsscmp": "1.0.5",
+    "uid-safe": "2.1.1"
+  },
+  "devDependencies": {
+    "bluebird": "3.4.0",
+    "eslint": "2.10.2",
+    "eslint-config-standard": "5.3.1",
+    "eslint-plugin-promise": "1.3.0",
+    "eslint-plugin-standard": "1.3.2",
+    "istanbul": "0.4.3",
+    "mocha": "2.5.3"
+  },
+  "files": [
+    "LICENSE",
+    "HISTORY.md",
+    "README.md",
+    "index.js"
+  ],
+  "engines": {
+    "node": ">= 0.8"
+  },
+  "scripts": {
+    "lint": "eslint **/*.js",
+    "test": "mocha --trace-deprecation --reporter spec --bail --check-leaks test/",
+    "test-cov": "istanbul cover node_modules/mocha/bin/_mocha -- --trace-deprecation --reporter dot --check-leaks test/",
+    "test-travis": "istanbul cover node_modules/mocha/bin/_mocha --report lcovonly -- --trace-deprecation --reporter spec --check-leaks test/"
+  },
+  "keywords": [
+    "csrf",
+    "tokens"
+  ],
+  "gitHead": "dbf7629bbff7ae14dfa7fab1b439e01b5ba3b629",
+  "bugs": {
+    "url": "https://github.com/pillarjs/csrf/issues"
+  },
+  "homepage": "https://github.com/pillarjs/csrf",
+  "_id": "csrf@3.0.3",
+  "_shasum": "69d13220de95762808bb120f7533a994fc4293b5",
+  "_from": "csrf@>=3.0.3 <3.1.0",
+  "_npmVersion": "1.4.28",
+  "_npmUser": {
+    "name": "dougwilson",
+    "email": "doug@somethingdoug.com"
+  },
+  "maintainers": [
+    {
+      "name": "dougwilson",
+      "email": "doug@somethingdoug.com"
+    },
+    {
+      "name": "dwolla",
+      "email": "api@dwolla.com"
+    },
+    {
+      "name": "jongleberry",
+      "email": "jonathanrichardong@gmail.com"
+    }
+  ],
+  "dist": {
+    "shasum": "69d13220de95762808bb120f7533a994fc4293b5",
+    "tarball": "https://registry.npmjs.org/csrf/-/csrf-3.0.3.tgz"
+  },
+  "_npmOperationalInternal": {
+    "host": "packages-12-west.internal.npmjs.com",
+    "tmp": "tmp/csrf-3.0.3.tgz_1464315403837_0.44625049154274166"
+  },
+  "directories": {},
+  "_resolved": "https://registry.npmjs.org/csrf/-/csrf-3.0.3.tgz"
+}
diff --git a/node_modules/csurf/package.json b/node_modules/csurf/package.json
new file mode 100644
index 0000000..1980cab
--- /dev/null
+++ b/node_modules/csurf/package.json
@@ -0,0 +1,109 @@
+{
+  "name": "csurf",
+  "description": "CSRF token middleware",
+  "version": "1.9.0",
+  "author": {
+    "name": "Jonathan Ong",
+    "email": "me@jongleberry.com",
+    "url": "http://jongleberry.com"
+  },
+  "contributors": [
+    {
+      "name": "Douglas Christopher Wilson",
+      "email": "doug@somethingdoug.com"
+    }
+  ],
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/expressjs/csurf"
+  },
+  "dependencies": {
+    "cookie": "0.3.1",
+    "cookie-signature": "1.0.6",
+    "csrf": "~3.0.3",
+    "http-errors": "~1.5.0"
+  },
+  "devDependencies": {
+    "body-parser": "1.15.1",
+    "connect": "3.4.1",
+    "cookie-parser": "1.4.3",
+    "cookie-session": "~1.1.0",
+    "eslint": "2.10.2",
+    "eslint-config-standard": "5.3.1",
+    "eslint-plugin-promise": "1.3.1",
+    "eslint-plugin-standard": "1.3.2",
+    "istanbul": "0.4.3",
+    "mocha": "2.5.3",
+    "supertest": "1.1.0"
+  },
+  "engines": {
+    "node": ">= 0.8.0"
+  },
+  "scripts": {
+    "lint": "eslint **/*.js",
+    "test": "mocha --check-leaks --reporter spec --bail test/",
+    "test-cov": "istanbul cover node_modules/mocha/bin/_mocha -- --check-leaks --reporter dot test/",
+    "test-travis": "istanbul cover node_modules/mocha/bin/_mocha --report lcovonly -- --check-leaks --reporter spec test/"
+  },
+  "files": [
+    "HISTORY.md",
+    "LICENSE",
+    "index.js"
+  ],
+  "keywords": [
+    "csrf",
+    "tokens",
+    "middleware",
+    "express"
+  ],
+  "gitHead": "6359a0298e1e3e937abb96c21958b2a4419d0301",
+  "bugs": {
+    "url": "https://github.com/expressjs/csurf/issues"
+  },
+  "homepage": "https://github.com/expressjs/csurf",
+  "_id": "csurf@1.9.0",
+  "_shasum": "49d2c6925ffcec7b7de559597c153fa533364133",
+  "_from": "csurf@latest",
+  "_npmVersion": "1.4.28",
+  "_npmUser": {
+    "name": "dougwilson",
+    "email": "doug@somethingdoug.com"
+  },
+  "maintainers": [
+    {
+      "name": "defunctzombie",
+      "email": "shtylman@gmail.com"
+    },
+    {
+      "name": "dougwilson",
+      "email": "doug@somethingdoug.com"
+    },
+    {
+      "name": "fishrock123",
+      "email": "fishrock123@rocketmail.com"
+    },
+    {
+      "name": "jongleberry",
+      "email": "jonathanrichardong@gmail.com"
+    },
+    {
+      "name": "mscdex",
+      "email": "mscdex@mscdex.net"
+    },
+    {
+      "name": "tjholowaychuk",
+      "email": "tj@vision-media.ca"
+    }
+  ],
+  "dist": {
+    "shasum": "49d2c6925ffcec7b7de559597c153fa533364133",
+    "tarball": "https://registry.npmjs.org/csurf/-/csurf-1.9.0.tgz"
+  },
+  "_npmOperationalInternal": {
+    "host": "packages-12-west.internal.npmjs.com",
+    "tmp": "tmp/csurf-1.9.0.tgz_1464369669689_0.553399148164317"
+  },
+  "directories": {},
+  "_resolved": "https://registry.npmjs.org/csurf/-/csurf-1.9.0.tgz"
+}