more cleanup in routes/user.js