another secrets.js fix
removed csrf trace from jade