refactor, use /server/api for API and /server/lib for express handlers