refactor as suggested in code review

e2e/scenario/api.spec.js

@@ -10,7 +10,7 @@ describe('API tests', function() {
             appMock = app;
         })
     });
-    
+
     afterAll(() => {
         appMock.server.close();
     });

e2e/scenario/fixture/api.spec.js

@@ -85,16 +85,14 @@ describe('api', function() {
       expect(err.status).toBe(403);
     });
 
-    request.csrf({
-      url: restServiceMockUrl + '/form'
-    }).then(function () {
-      request.post(restServiceMockUrl + '/form').send({
-        field: 'value'
-      }).do().then(function (res) {
-        expect(res.status).toBe(200);
-      }).catch(function (err) {
-        expect(true).toBeFalsy();
-      });
+    request.authenticate(new CsrfAuthenticator({
+      csrfFetchUrl: restServiceMockUrl + '/form'
+    }));
+
+    request.post(restServiceMockUrl + '/form').send({
+      field: 'value'
+    }).do().then(function (res) {
+      expect(res.status).toBe(200);
     });
   });
 

e2e/scenario/fixture/mock/apiServiceMock.js

@@ -5,6 +5,7 @@ var csrf = require('csurf');
 
 module.exports = function() {
   var app = express();
+  // will also use a _csrf cookie (secret) and validate against it
   var csrfProtection = csrf({
     cookie: true
   });
@@ -86,9 +87,10 @@ module.exports = function() {
 
   app.get('/form', csrfProtection, function (req, res) {
     if (req.headers['x-csrf-token'].toLowerCase() === 'fetch') {
-      res.set('x-csrf-token', req.csrfToken());
+      var csrfToken = req.csrfToken();
+      res.set('x-csrf-token', csrfToken);
       res.send({
-        csrfToken: req.csrfToken()
+        csrfToken: csrfToken
       });
     } else {
       res.sendStatus(200);