use evilpacket/express-secure-skeleton as a starting point