why do we need to pass `app` here? in theory once the first request comes in. you can get a handle on the app by doing `req.app`.