this needs a `return res.end('error');` otherwise we call `.end()` twice.