text: var express = require('express')
  var app = express()
  var path = require('path')
  var cookieParser = require('cookie-parser')
  var bodyParser = require('body-parser')
  app.use(cookieParser())
  app.use(bodyParser())
  app.use(express.static(path.resolve(__dirname, 'public')))
  
  const isCSRFProtectionEnabled = process.env.CSRF_PROTECTION
  
  var ledger = {
    me: 100,
    you: 0.99
  }
  
  var authCookieName = 'auth'
  var csrfHeaderName = 'csrf-token'
  var fakeAuthCookieValue = 'fake-p@$$0|2d'
  var fakeCSRFToken = '2noarstno32r_test-csrf-token_2oin3io'
  
  function generic401 (res) {
    return res
    .status(401)
    .set('Content-Type', 'text/html')
    .send('<h1>401 Unauthorized</h1>')
    .end()
  }
  
  function isCSRFRequest (req) {
    if (isCSRFProtectionEnabled && req.headers[csrfHeaderName] !== fakeCSRFToken) return true
    return false
  }
  
  app.post('/api/login', function (req, res) {
    const { username, password } = req.body
    if (username !== 'admin' || password !== 'admin') return generic401(res)
    var payload = {}
    payload.csrfToken = fakeCSRFToken
    res
    .cookie(authCookieName, fakeAuthCookieValue, { httpOnly: true })
    .set('Content-Type', 'application/json')
    .send(payload)
    .end()
  })
  
  app.get('/api/balance', function (req, res) {
    if (!req.cookies || req.cookies[authCookieName] !== fakeAuthCookieValue) return generic401(res)
    if (isCSRFRequest(req)) return generic401(res)
    res
    .set('Content-Type', 'application/json')
    .send(ledger)
    .end()
  })
  
  app.get('/api/transfer', function (req, res) {
    if (!req.cookies || req.cookies[authCookieName] !== fakeAuthCookieValue) return generic401(res)
    if (isCSRFRequest(req)) return generic401(res)
    var { from, to, amount } = req.query
    if (!from || !to || !amount) return res.code(400).send('bad input')
    ledger[from] = ledger[from] - parseFloat(amount)
    ledger[to] = ledger[to] + parseFloat(amount)
    res
    .set('Content-Type', 'application/json')
    .send(Object.assign(ledger, {
      action: `transferred $${parseFloat(amount, 10).toFixed(2)} from ${from} to ${to} successfully`
    }))
    .end()
  })
  
  app.listen(7777)
  