change routes to use req.body