Why does my Node app return 404 on this POST request?

I'm so sure that I made some silly error somewhere in my app, but I just can't seem to find it.

So here's what my Express app looks like. I have my routes set up as such:

var routes = require('./routes');
...
app.get('/', routes.index);
app.get('/embed', routes.embed);
app.post('/upload', routes.upload);

In my routes folder, I have two files. The index.js file exports the two request handlers .index and .embed. It might be helpful to know that .embed creates a CSRF token to be used on the /embed page:

exports.embed = function(req, res){
  var csrf = req.session._csrf;
  res.render('embed', { token: csrf });
};


form#secret-form(name="secret-form", method="post", action="/upload", style="")
  input(type="hidden", name="_csrf", value="#{token}")
  input(type="hidden", name="image")
  input#send-button(type="submit") Upload

Just a brief note if it's causing the issue: I did attach a .submit jQuery handler to this form; it simply grabs the data URL from a canvas object on this page, and puts that as the value to the input field with the name "image".

The .upload route is handled in the routes/upload.js file. It looks something like this:

exports.upload = function(req, res) {
  console.log("Receiving upload...");
  var imageURL = req.body.image;
  // snippet of code that grabs a canvas data URL and stores it in a file
};

I don't think the contents of this function matters because I get the following log output for requests going to /upload from the /embed form. It doesn't even print the "Receiving upload..." line; it simply returns a page that says "Cannot POST /upload":

127.0.0.1 - - [Thu, 26 Jul 2012 04:07:41 GMT] "POST /upload HTTP/1.1" 404 - "http://0.0.0.0:3000/embed"

So, what can I possibly be doing wrong here? Is it my app configuration? I suspect it might be so since the POST requests stopped working after I added CSRF support. But now I'm just speculating...

app.configure(function(){
  app.set('views', __dirname + '/views');
  app.set('view engine', 'jade');
  app.use(express.bodyParser());
  app.use(express.methodOverride());
  //app.use(express.limit('1mb'));
  app.use(express.query());
  app.use(express.logger());

  // CSRF stuff
  app.use(express.cookieParser());
  app.use(express.session({ secret: "secret", cookie: { maxAge: 60000 } }));
  app.use(express.csrf());

  app.use(app.router);
  app.use(express.static(__dirname + '/public'));
});