use res.status, res.json(status) is deprecated