changed from req.params to req.query