through
remember to res.end if it's not post request