tidy up app.js, fix middleware, etc