Convert enableCsrf to middleware

[mtlynch]

Per discussion for #144, we can clean up the code in routes.go if we convert enableCsrf to a middleware function that we can call with:

s.router.Use(s.enableCsrf)