Why does my Node app return 404 on this POST request?
===

I'm so sure that I made some silly error somewhere in my app, but I just can't seem to find it.

So here's what my Express app looks like. I have my routes set up as such:

    var routes = require('./routes');
    ...
    app.get('/', routes.index);
    app.get('/embed', routes.embed);
    app.post('/upload', routes.upload);

In my routes folder, I have two files. The index.js file exports the two request handlers `.index` and `.embed`. It might be helpful to know that `.embed` creates a CSRF token to be used on the `/embed` page:

    exports.embed = function(req, res){
      var csrf = req.session._csrf;
      res.render('embed', { token: csrf });
    };


    form#secret-form(name="secret-form", method="post", action="/upload", style="")
      input(type="hidden", name="_csrf", value="#{token}")
      input(type="hidden", name="image")
      input#send-button(type="submit") Upload

Just a brief note if it's causing the issue: I did attach a `.submit` jQuery handler to this form; it simply grabs the data URL from a canvas object on this page, and puts that as the value to the input field with the name "image".

The `.upload` route is handled in the routes/upload.js file. It looks something like this:

    exports.upload = function(req, res) {
      console.log("Receiving upload...");
      var imageURL = req.body.image;
      // snippet of code that grabs a canvas data URL and stores it in a file
    };

I don't think the contents of this function matters because I get the following log output for requests going to `/upload` from the `/embed` form. It doesn't even print the "Receiving upload..." line; it simply returns a page that says "Cannot POST /upload":

    127.0.0.1 - - [Thu, 26 Jul 2012 04:07:41 GMT] "POST /upload HTTP/1.1" 404 - "http://0.0.0.0:3000/embed"

So, what can I possibly be doing wrong here? Is it my app configuration? I suspect it might be so since the POST requests stopped working after I added CSRF support. But now I'm just speculating...

    app.configure(function(){
      app.set('views', __dirname + '/views');
      app.set('view engine', 'jade');
      app.use(express.bodyParser());
      app.use(express.methodOverride());
      //app.use(express.limit('1mb'));
      app.use(express.query());
      app.use(express.logger());

      // CSRF stuff
      app.use(express.cookieParser());
      app.use(express.session({ secret: "secret", cookie: { maxAge: 60000 } }));
      app.use(express.csrf());

      app.use(app.router);
      app.use(express.static(__dirname + '/public'));
    });
