jQuery AJAX - CSRF 500 internal server error

// USER SIGN UP ==============================================================
app.get('/user/create', isLoggedIn, (req, res, next) => {
  let messages = req.flash('error');
  res.json({ csrfToken: req.csrfToken() });
});

// Handle user create on POST =============================================
  app.post('/user/create', isLoggedIn, (req, res, next) => {
    req.checkBody('username').notEmpty();
    req.checkBody('password').notEmpty();

    req.sanitize('username').escape();
    req.sanitize('username').trim();
    req.sanitize('password').trim();

    let newUser = new User({
      username: req.body.username,
      password: req.body.password
    });

    let errors = req.validationErrors();
    if (errors) {
      res.json({ csrfToken: req.csrfToken() });
    } else {
      // Data from form is valid, lets save it
      newUser.save((err) => {
        if (err) {
          return next(err);
        }

        res.redirect('/user');
      });
    }
  });

#####################################################################################
<button type="button" name="button" class="btn btn-primary" id="add-user">
   <i class="fa fa-plus" aria-hidden="true">&nbsp;New User</i>
</button>

======= Modal - Form Create User =======
<form action="/user/create" id="account-form" class="form-horizontal" method="post">
    <div class="col-md-12">
      <div class="form-group">
          <label for="username" class="col-md-3 control-label">Username</label>
          <div class="col-md-8">
              <input type="text" name="username" class="form-control" id="username" placeholder="Username"/>
          </div>
      </div>
      <div class="form-group">
          <label for="password" class="col-md-3 control-label">Password</label>
          <div class="col-md-8">
              <input type="password" name="password" class="form-control" id="password" placeholder="Password"/>
          </div>
      </div>
    </div>
    <div class="form-group">
        <div class="col-sm-6 col-sm-offset-6">
            <input type="hidden" id="token-key" name="_csrf">
            <button type="submit" name="button" class="btn btn-primary">
                <i class="fa fa-save"></i>
                &nbsp;Process
            </button>
        </div>
    </div>
</form>

====== Show Modal & set the csrfToken value =========
$('#add-user').click(function () {

  var url = "http://localhost:3000/user/create";

  $.ajax({
    type: "GET",
    url: url,
    dataType: "json",
    success: function (data) {
      var token = data.csrfToken;

      $('input[name="_csrf"]').val(token);
      $('#modal-adduser').modal('show');
    }
  });
});

========== Event for form submit ==============
$('form#account-form').submit(function (event) {
  event.preventDefault();

  var urlcreate = "http://localhost:3000/user/create";
  var formData = {
    'username': $('input[name="username"]').val(),
    'password': $('input[name="password"]').val()
  };

  $.ajaxSetup({
      headers:
      { 'X-CSRF-TOKEN': $('input[name="_csrf"]').val() }
  });

  $.ajax({
    type: "POST",
    url: urlcreate,
    data: formData,
    dataType: "json",
    success: function (result) {
      console.log(result);
    }
  });

});