csrf useless

[imskull]

I set a breakpoint at csrf.js:
// check
if (val != token) return next(403); << breakpoint here
it never triggered whatever I did.
the code is trying to protect res in '/public', but csrf is only avaliable on POST because:
..csrf.js..
// ignore these methods
if ('GET' == req.method || 'HEAD' == req.method || 'OPTIONS' == req.method) return next();
it's very weird.