title: Are the locals passed to `res.render()` secure enough to contain sensitive information?
body: <p>I'm fairly new to the server-side aspect of web development, and I'm trying to selectively display certain elements depending on the user's access privileges (i.e. whether he's an admin or not). I was thinking of doing something like this using Pug.:</p>
  
  <pre><code>&lt;body&gt;
  &lt;h1&gt; Header &lt;/h1&gt;
  if locals.is_admin
      p.admin-only Admin-only Content
  &lt;/body&gt;
  </code></pre>
  
  <p>I would assume this data is discarded after the page is created from the template, but I know better than to trust my assumptions when security is involved. So, would this be safe to do?</p>