Update server.js

Fix: allow is not self variable but member of req.
Merge pull request #432 from vencax/master

Update server.js