use winston for logging

was originally going to do log4js, but winston is nicer