use res.json 500 vs throw here (like above)