move routes out of server.js