refactor as suggested in code review

e2e/scenario/fixture/api.spec.js

@@ -85,14 +85,14 @@ describe('api', function() {
       expect(err.status).toBe(403);
     });
 
-    request.csrf({
-      url: restServiceMockUrl + '/form'
-    }).then(function () {
+    request.authenticate(new CsrfAuthenticator({
+      csrfFetchUrl: restServiceMockUrl + '/form'
+    })).then(function () {
       request.post(restServiceMockUrl + '/form').send({
         field: 'value'
       }).do().then(function (res) {
         expect(res.status).toBe(200);
-      }).catch(function (err) {
+      }).catch(function () {
         expect(true).toBeFalsy();
       });
     });

e2e/scenario/fixture/mock/apiServiceMock.js

@@ -5,6 +5,7 @@ var csrf = require('csurf');
 
 module.exports = function() {
   var app = express();
+  // will also use a _csrf cookie (secret) and validate against it
   var csrfProtection = csrf({
     cookie: true
   });
@@ -86,9 +87,10 @@ module.exports = function() {
 
   app.get('/form', csrfProtection, function (req, res) {
     if (req.headers['x-csrf-token'].toLowerCase() === 'fetch') {
-      res.set('x-csrf-token', req.csrfToken());
+      var csrfToken = req.csrfToken();
+      res.set('x-csrf-token', csrfToken);
       res.send({
-        csrfToken: req.csrfToken()
+        csrfToken: csrfToken
       });
     } else {
       res.sendStatus(200);