(1) Switched /api/private/:user to POST, (2) Fixed app.js order