moved api-only routes into routes/api.js, cleanup & linting