Use Express 4 Router API

- Refactor `User` and `Job` routes to use Express 4's `router`.
- Validate `Document.update` calls