app.js correctly calls /publickeys/