function defaultValue(req) {
  return (req.body && req.body._csrf)
    || (req.query && req.query._csrf)
    || (req.headers['x-csrf-token'])
    || (req.headers['x-xsrf-token']);
}
Default value function, checking the `req.body`
and `req.query` for the CSRF token.

@param {IncomingMessage} req
@return {String}
@api private