seems like we shouldn't need to check for `'server'` because it should never even get to this point in the API if it's not a server-side request?

not sure what refactoring that would require elsewhere