added isLoggedIn to protect routes in routes.js, cleaned up previous routes from server.js