refactored app/api.js back to global router calls (didn't need to pass in db after all)