Kraken.js + Lusca integration: declarative CSRF config and session middleware ordering

Kraken.js and Lusca at the middleware boundary

Kraken.js wires Lusca's security modules declaratively through the lusca key in config.json, rather than through imperative app.use() calls. My goal is to enable Lusca's CSRF protection in a Kraken app while keeping the guarantee that the session middleware it depends on is registered before Lusca in the middleware chain.

The uncertainty is at the integration boundary: Kraken controls middleware registration order based on its configuration and medley of registered handlers, so it is not obvious how to confirm — or enforce — that session-backed CSRF tokens are actually validated on POST routes. A misordered chain could fail silently, leaving forms unprotected without any startup error. I am also unsure which Lusca modules (CSP, X-Frame-Options, HSTS) are enabled by a default Kraken config versus which must be opted into per environment file.

Assume current Express 4.x with the latest published Kraken.js and Lusca releases; compatibility should be verified given Lusca's low maintenance activity.

1. How can I verify, from configuration alone or via a response inspection, that Lusca's CSRF module runs after session middleware in a Kraken-managed app?
2. Which Lusca protections are off by default and must be explicitly enabled in production.json?
3. Is there a supported way to assert at startup that CSRF enforcement is active, rather than discovering a gap at runtime?