MAP-2010 remove calls to old csrf library as now using csrf-sync (#757)

The call to setUpCsrf() ensures csrf token is available for all endpoints as implemented in the template project.
This includes the unauthenticated endpoints: /removal-requested, /already-removed and /removal-already-requested.
These unathenticated endpoints enable staff to be removed from the 'Staff involved' list via the email prompting them to create a statement.
And even though these endpoints don't specifically set _csrf token in the html, it will not have an advserse affect because the html doesn't include any forms.

server/routes/index.ts

@@ -5,7 +5,6 @@ import creatingReportsRoutes from './creatingReports'
 import maintainingReportsRoutes from './maintainingReports'
 import viewingReportsRoutes from './viewingReports'
 import apiRoutes from './api'
-import csrf from '../middleware/csrfMiddleware'
 
 import type { Services } from '../services'
 
@@ -16,9 +15,6 @@ export default function Index(authenticationMiddleware: Handler, services: Servi
   router.use(flash())
 
   router.use(authenticationMiddleware)
-
-  router.use(csrf())
-
   router.use(creatingReportsRoutes(services))
   router.use(maintainingReportsRoutes(services))
   router.use(viewingReportsRoutes(services))

server/routes/unauthenticated/index.ts

@@ -4,15 +4,14 @@ import asyncMiddleware from '../../middleware/asyncMiddleware'
 
 import type { Services } from '../../services'
 import RemovalRequest from './requestRemoval'
-import csrf from '../../middleware/csrfMiddleware'
 
 export default function UnauthenticatedRoutes(services: Services): Router {
   const { reportService, statementService, systemToken } = services
 
   const router = express.Router()
 
   const removalRequest = new RemovalRequest(reportService, statementService, systemToken)
-  router.get('/request-removal/:statementId', flash(), csrf(), asyncMiddleware(removalRequest.view))
+  router.get('/request-removal/:statementId', flash(), asyncMiddleware(removalRequest.view))
   router.post('/request-removal/:statementId', flash(), asyncMiddleware(removalRequest.submit))
 
   router.get('/removal-requested', removalRequest.viewConfirmation)