chore(server): Move api-server in to it's own DIR

api-server/server/middlewares/csurf.js

@@ -0,0 +1,19 @@
+import csurf from 'csurf';
+
+export default function() {
+  const protection = csurf(
+    {
+      cookie: {
+        domain: process.env.COOKIE_DOMAIN || 'localhost'
+      }
+    }
+  );
+  return function csrf(req, res, next) {
+
+    const path = req.path.split('/')[1];
+    if (/(^api$|^external$|^internal$|^p$)/.test(path)) {
+      return next();
+    }
+    return protection(req, res, next);
+  };
+}