Refactored routes to be seperate from other server configuration

Routes are still testable by being modular, accepting control objects like
an express app and/or initialised passport.