cleaned up what is send to user, error handles if no username in url query
attemped to strengthen security of api's and routes; need to unit test