Can we move web, api and bull into this repo about lad

[niftylettuce]

Upgrade to v0.4.12 of @ladjs/web and then implement the following change:

const web = new Web({
// ....
+  csrfIgnoredGlobs: [ '/wcendpoint' ]
-  csrf: false,
});
-if (process.env.NODE_ENV !== 'test') {
-  const csrf = new CSRF({
-    ...config.csrf,
-    invalidTokenMessage: ctx => ctx.request.t('Invalid CSRF token')
-  });
-
-  web.app.use(async (ctx, next) => {
-    try {
-      if(ctx.request.url === '/wcendpoint') {
-        await next();
-      } else {
-        await csrf(ctx, next);
-      }
-    } catch (err) {
-      let e = err;
-      if (err.name && err.name === 'ForbiddenError') {
-        e = Boom.forbidden(err.message);
-        if (err.stack) e.stack = err.stack;
-      }
-      ctx.throw(e);
-    }
-  });
-}

I have added csrfIgnoredGlobs (Array) option.

Note you can use wildcards and glob patterns, e.g. /wcendpoint, /wcendpoint/**/*, /wcendpoint/*, /foo/**/bar, ...