I'm trying to setup csrf protection using cookie-session as the csurf docs mention it explicitly, but loading my /form page returns a 500 and 'misconfigured csrf' is logged to the console.

import csrf from 'csurf'
import express from 'express'
import cookieSession from 'cookie-session'

const app = express()
const CookieSettings = {
  name: 'session',
  keys: ['keyone', 'keytwo'],
  httpOnly: true
}
//template engine stuff
app.use(cookieSession(CookieSettings))
app.use(csrf({ cookie: true }))
app.use(express.urlencoded({ extended: true }))

app.get('/form', (req, res) => {
  res.render('form.html', { csrf: req.csrfToken() })
}
app.post('/form', (req, res) => {
  console.log('CSRF: ', req.body._csrf)
  res.redirect(303, '/form')
}

app.listen(3000)