refactored server-side routes.js to use auth service