fixed client app.js to find correct session key to decrypt