Fix a bug where secureID wouldn't be sent on only the first load

The problem was because index.html was in the public folder and was
being served on the first page load instead of the Pug view being
rendered. The solution was to move it into the views folder so that the
only way to get to it was through the template engine.

views/index.pug

@@ -1,4 +1,4 @@
 doctype html
 script.
   var secureID = '!{secureID}';
-include ../public/index.html
+include index.html