title: Error: CSRF token missing, hackathon-starter plus AngularJS
body: <p>I'm integrating AngularJS into hackathon-starter. It was done as I mentioned it <a href="https://stackoverflow.com/questions/24121182/include-angular-into-hackathon-starter/29718416#29718416">here</a> with the following test.html and test.controller.js</p>
  
  <pre><code>&lt;div&gt;
      The record: {{record}}
  &lt;/div&gt;
  
  &lt;div align="right"&gt;
      &lt;button class="btn btn-lg btn-primary" ng-click="createRecord()" onclick="window.location.href='/order/shipping'"&gt;
          &lt;i class=""&gt; Create record&lt;/i&gt;
      &lt;/button&gt;
  &lt;/div&gt;
  </code></pre>
  
  <p>test.controller.js</p>
  
  <pre><code>(function () {
  
  'use strict';
  var injectParams = ['$scope', '$location', '$http'];
  
  function TestController($scope, $location, $http) {
  
      $scope.record = {
          interId: 1,
          sku: '107k',
          category: 'Useful'
      };
  
      function createRecord(record) {
          return $http.post('/order/create', record).then(function (response) {
              return response.data;
          })
      }
  
      $scope.createRecord = function () {
  
          var record = $scope.record;
  
          createRecord(record)
              .then(function (data) {
                  if (data.success) {
                      return $location.url('/shipping');
                  }
                  alert('Something wrong...');
              });
      }
  };
  
  TestController.$inject = injectParams;
  
  angular.module('miniApp')
      .controller('TestController', TestController);
  }());
  </code></pre>
  
  <p>It works if the value for csrf is set to false, like:</p>
  
  <pre><code> app.use(lusca({
      csrf: false,
      xframe: 'SAMEORIGIN',
      xssProtection: true }));
  </code></pre>
  
  <p>When the value for csrf is set to true, than there is the error: 
  <strong>Error: CSRF token missing</strong></p>
  
  <p>One of the options to solve this problem is to put request for '/order/create' path before the lusca configuration, like:</p>
  
  <pre><code>app.post('/order/create', passportConf.isAuthenticated, orderController.postCreateOrder);
  app.use(lusca({
  csrf: true,
  </code></pre>
  
  <p>...</p>
  
  <p>But this solution is not quite elegant.</p>
  
  <p>Another option would be to <a href="https://github.com/sahat/hackathon-starter#faq" rel="nofollow noreferrer">whitelist dynamic URLs using regular expression</a> inside the CSRF middleware. I tried this approach but I lack of experience how to do it properly. <strong>How to solve this problem with whitelisting (concrete example)?</strong></p>
  
  <p>I could be wrong, but it should be possible to pass the csrf within test.controller.js. How to do it I don't know. So, it would be nice if somebody would provide concrete example.</p>
  
  <p>A solution with the whitelisting would be excepted because I couldn't figure out how to make it work.</p>