use req.url, not req.path