Update server.js

Fix: allow is not self variable but member of req.