Fix csrfSecret handling

Closes #2974
-use req.session.csrfSecret instead of _csrfSecret.
-clear username and password properties from the signin controller.
Merge pull request #2975 from jaswilli/csrf

Fix csrfSecret handling