moved routes out of app.js