remove app.post

remove app.post for calls that require secret key submission