code: function(parent, app) {
          this.use(middleware.sanitizeHost(app));
          this.use(middleware.bodyParser());
          this.use(middleware.cookieParser());
          this.use(middleware.fragmentRedirect());
      }
docs: Removing validateCSRFToken to replace with connect's csrf middleware.
  Double CSRF protection makes dealing with static forms difficult by default.