condense non-html / non-crypto code to server.go