Update app.js

remove credentials