don't assume `app` or `server` is an express object

requires options be explicitly set on the parameter