Fix csrfSecret handling

Closes #2974
-use req.session.csrfSecret instead of _csrfSecret.
-clear username and password properties from the signin controller.
This should probably not be done unless the sign-in was successful.  I'd hate to have to type my username again if I fat fingered my password.