diff --git a/package.json b/package.json
index 92829aa00e..687a2fe0f7 100644
--- a/package.json
+++ b/package.json
@@ -14,13 +14,17 @@
     "babel-preset-es2015": "^6.6.0",
     "babel-register": "^6.6.0",
     "babelify": "^7.2.0",
+    "body-parser": "^1.15.0",
     "bower": "~1.3.12",
     "browserify": "~12.0.1",
+    "compression": "^1.6.1",
     "connect-ratelimit": "0.0.7",
+    "cookie-parser": "^1.4.1",
     "coupon-code": "~0.3.0",
     "domain-middleware": "~0.1.0",
-    "express": "~3.17.5",
+    "express": "^4.13.4",
     "express-csv": "~0.6.0",
+    "express-session": "^1.13.0",
     "firebase": "^2.2.9",
     "firebase-token-generator": "^2.0.0",
     "glob": "^4.3.5",
@@ -56,6 +60,7 @@
     "moment": "~2.8.3",
     "mongoose": "~3.8.23",
     "mongoose-id-autoinc": "~2013.7.14-4",
+    "morgan": "^1.7.0",
     "nconf": "~0.6.9",
     "newrelic": "~1.25.0",
     "nib": "~1.0.1",
@@ -72,6 +77,7 @@
     "qs": "^2.3.2",
     "request": "~2.44.0",
     "s3-upload-stream": "^1.0.6",
+    "serve-favicon": "^2.3.0",
     "stripe": "^4.2.0",
     "superagent": "~1.4.0",
     "swagger-node-express": "lefnire/swagger-node-express#habitrpg",
diff --git a/website/src/routes/api-v1.js b/website/src/routes/api-v1.js
index 1002391cae..b3408f523d 100644
--- a/website/src/routes/api-v1.js
+++ b/website/src/routes/api-v1.js
@@ -1,5 +1,5 @@
 var express = require('express');
-var router = new express.Router();
+var router = express.Router();
 var _ = require('lodash');
 var async = require('async');
 var icalendar = require('icalendar');
@@ -170,4 +170,4 @@ router.get('*', i18n.getUserLanguage, deprecated);
 router.post('*', i18n.getUserLanguage, deprecated);
 router.put('*', i18n.getUserLanguage, deprecated);
 
-module.exports = router;
\ No newline at end of file
+module.exports = router;
diff --git a/website/src/routes/api-v2/auth.js b/website/src/routes/api-v2/auth.js
index 39f2f6e069..62e506d097 100644
--- a/website/src/routes/api-v2/auth.js
+++ b/website/src/routes/api-v2/auth.js
@@ -1,7 +1,7 @@
 var auth = require('../../controllers/api-v2/auth');
 var express = require('express');
 var i18n = require('../../libs/i18n');
-var router = new express.Router();
+var router = express.Router();
 
 /* auth.auth*/
 auth.setupPassport(router); //FIXME make this consistent with the others
@@ -15,7 +15,7 @@ router.post('/api/v2/user/change-username', i18n.getUserLanguage, auth.auth, aut
 router.post('/api/v2/user/change-email', i18n.getUserLanguage, auth.auth, auth.changeEmail);
 router.post('/api/v2/user/auth/firebase', i18n.getUserLanguage, auth.auth, auth.getFirebaseToken);
 
-router.post('/api/v1/register', i18n.getUserLanguage, auth.registerUser);    
-router.post('/api/v1/user/auth/local', i18n.getUserLanguage, auth.loginLocal);   
-router.post('/api/v1/user/auth/social', i18n.getUserLanguage, auth.loginSocial);   
-module.exports = router;
\ No newline at end of file
+router.post('/api/v1/register', i18n.getUserLanguage, auth.registerUser);
+router.post('/api/v1/user/auth/local', i18n.getUserLanguage, auth.loginLocal);
+router.post('/api/v1/user/auth/social', i18n.getUserLanguage, auth.loginSocial);
+module.exports = router;
diff --git a/website/src/routes/api-v2/coupon.js b/website/src/routes/api-v2/coupon.js
index 811d81a6f2..9057758d3a 100644
--- a/website/src/routes/api-v2/coupon.js
+++ b/website/src/routes/api-v2/coupon.js
@@ -1,6 +1,6 @@
 var nconf = require('nconf');
 var express = require('express');
-var router = new express.Router();
+var router = express.Router();
 var auth = require('../../controllers/api-v2/auth');
 var coupon = require('../../controllers/api-v2/coupon');
 var i18n = require('../../libs/i18n');
@@ -9,4 +9,4 @@ router.get('/api/v2/coupons', auth.authWithUrl, i18n.getUserLanguage, coupon.ens
 router.post('/api/v2/coupons/generate/:event', auth.auth, i18n.getUserLanguage, coupon.ensureAdmin, coupon.generateCoupons);
 router.post('/api/v2/user/coupon/:code', auth.auth, i18n.getUserLanguage, coupon.enterCode);
 
-module.exports = router;
\ No newline at end of file
+module.exports = router;
diff --git a/website/src/routes/api-v2/unsubscription.js b/website/src/routes/api-v2/unsubscription.js
index 942a396eef..882fb10392 100644
--- a/website/src/routes/api-v2/unsubscription.js
+++ b/website/src/routes/api-v2/unsubscription.js
@@ -1,8 +1,8 @@
 var express = require('express');
-var router = new express.Router();
+var router = express.Router();
 var i18n = require('../../libs/i18n');
 var unsubscription = require('../../controllers/api-v2/unsubscription');
 
 router.get('/unsubscribe', i18n.getUserLanguage, unsubscription.unsubscribe);
 
-module.exports = router;
\ No newline at end of file
+module.exports = router;
diff --git a/website/src/routes/dataexport.js b/website/src/routes/dataexport.js
index 5bf02a228c..9dd8511e3d 100644
--- a/website/src/routes/dataexport.js
+++ b/website/src/routes/dataexport.js
@@ -1,5 +1,5 @@
 var express = require('express');
-var router = new express.Router();
+var router = express.Router();
 var dataexport = require('../controllers/dataexport');
 var auth = require('../controllers/api-v2/auth');
 var nconf = require('nconf');
diff --git a/website/src/routes/pages.js b/website/src/routes/pages.js
index 684be46ccb..3c8ee639a4 100644
--- a/website/src/routes/pages.js
+++ b/website/src/routes/pages.js
@@ -1,6 +1,6 @@
 var nconf = require('nconf');
 var express = require('express');
-var router = new express.Router();
+var router = express.Router();
 var _ = require('lodash');
 var locals = require('../middlewares/locals');
 var i18n = require('../libs/i18n');
diff --git a/website/src/routes/payments.js b/website/src/routes/payments.js
index 41c03210be..c385c835c7 100644
--- a/website/src/routes/payments.js
+++ b/website/src/routes/payments.js
@@ -1,6 +1,6 @@
 var nconf = require('nconf');
 var express = require('express');
-var router = new express.Router();
+var router = express.Router();
 var auth = require('../controllers/api-v2/auth');
 var payments = require('../controllers/payments');
 var i18n = require('../libs/i18n');
@@ -28,4 +28,4 @@ router.post('/iap/ios/verify', auth.auth, /*i18n.getUserLanguage, */ payments.ia
 
 router.get('/api/v2/coupons/valid-discount/:code', /*auth.authWithUrl, i18n.getUserLanguage, */ payments.validCoupon);
 
-module.exports = router;
\ No newline at end of file
+module.exports = router;
diff --git a/website/src/server.js b/website/src/server.js
index ea2907a499..f16c641946 100644
--- a/website/src/server.js
+++ b/website/src/server.js
@@ -27,6 +27,13 @@ if (cores!==0 && cluster.isMaster && (isDev || isProd)) {
 
 } else {
   var express = require("express");
+  var bodyParser = require('body-parser');
+  var session = require('express-session');
+  var cookieParser = require('cookie-parser');
+  var logger = require('morgan');
+  var compression = require('compression');
+  var favicon = require('serve-favicon');
+
   var http = require("http");
   var path = require("path");
   var swagger = require("swagger-node-express");
@@ -102,8 +109,6 @@ if (cores!==0 && cluster.isMaster && (isDev || isProd)) {
   var oldApp = express(); // api v1 and v2, and not scoped routes
   var newApp = express(); // api v3
 
-  // Route requests to the right app
-  app.use(app.router);
   // Matches all request except the ones going to /api/v3/**
   app.all(/^(?!\/api\/v3).+/i, oldApp);
   // Matches all requests going to /api/v3
@@ -111,22 +116,22 @@ if (cores!==0 && cluster.isMaster && (isDev || isProd)) {
 
   require('./middlewares/apiThrottle')(oldApp);
   oldApp.use(require('./middlewares/domain')(server,mongoose));
-  if (!isProd && !DISABLE_LOGGING) oldApp.use(express.logger("dev"));
-  oldApp.use(express.compress());
+  if (!isProd && !DISABLE_LOGGING) oldApp.use(logger("dev"));
+  oldApp.use(compression());
   oldApp.set("views", __dirname + "/../views");
   oldApp.set("view engine", "jade");
-  oldApp.use(express.favicon(publicDir + '/favicon.ico'));
+  oldApp.use(favicon(publicDir + '/favicon.ico'));
   oldApp.use(require('./middlewares/cors'));
 
   var redirects = require('./middlewares/redirects');
   oldApp.use(redirects.forceHabitica);
   oldApp.use(redirects.forceSSL);
-  oldApp.use(express.urlencoded());
-  oldApp.use(express.json());
+  oldApp.use(bodyParser.urlencoded());
+  oldApp.use(bodyParser.json());
   oldApp.use(require('method-override')());
   //oldApp.use(express.cookieParser(nconf.get('SESSION_SECRET')));
-  oldApp.use(express.cookieParser());
-  oldApp.use(express.cookieSession({ secret: nconf.get('SESSION_SECRET'), httpOnly: false, cookie: { maxAge: TWO_WEEKS }}));
+  oldApp.use(cookieParser());
+  oldApp.use(session({ secret: nconf.get('SESSION_SECRET'), httpOnly: false, cookie: { maxAge: TWO_WEEKS }}));
   //oldApp.use(express.session());
 
   // Initialize Passport!  Also use passport.session() middleware, to support
@@ -134,8 +139,6 @@ if (cores!==0 && cluster.isMaster && (isDev || isProd)) {
   oldApp.use(passport.initialize());
   oldApp.use(passport.session());
 
-  oldApp.use(oldApp.router);
-
   var maxAge = isProd ? 31536000000 : 0;
   // Cache emojis without copying them to build, they are too many
   oldApp.use(express['static'](path.join(__dirname, "/../build"), { maxAge: maxAge }));
@@ -146,15 +149,15 @@ if (cores!==0 && cluster.isMaster && (isDev || isProd)) {
   oldApp.use(express['static'](publicDir));
 
   // Custom Directives
-  oldApp.use(require('./routes/pages').middleware);
-  oldApp.use(require('./routes/payments').middleware);
-  oldApp.use(require('./routes/api-v2/auth').middleware);
-  oldApp.use(require('./routes/api-v2/coupon').middleware);
-  oldApp.use(require('./routes/api-v2/unsubscription').middleware);
+  oldApp.use('/', require('./routes/pages'));
+  oldApp.use('/', require('./routes/payments'));
+  oldApp.use('/', require('./routes/api-v2/auth'));
+  oldApp.use('/', require('./routes/api-v2/coupon'));
+  oldApp.use('/', require('./routes/api-v2/unsubscription'));
   var v2 = express();
   oldApp.use('/api/v2', v2);
-  oldApp.use('/api/v1', require('./routes/api-v1').middleware);
-  oldApp.use('/export', require('./routes/dataexport').middleware);
+  oldApp.use('/api/', require('./routes/api-v1'));
+  oldApp.use('/export', require('./routes/dataexport'));
   require('./routes/api-v2/swagger')(swagger, v2);
   oldApp.use(require('./middlewares/errorHandler'));