small cleanup in server.js
add winston logging