enable functional testing of the express app

* don't start server if index.js is require()'d
* expose the express app object

this allows to require() the index.js file to run tests against it on ephemeral
ports (as done by supertest and chai-http)