This could be flattened by inverting this condition and bailing out early with a return statement after setting the appropriate HTTP response (probably 405). This check should probably also be done for the /api/hosts route as well.