Update app.js

security