Fix for timing attack
change res.locals to a plain js object.
Anyone who wants something fancier should use modules. - fixes annoyance with not being able to set 'name' property on locals
Another util bites the dust.
This has been warning about deprecation for a long time. Use `express()` to instantiate an express app.
update the tests to show a difference between `send(null)` and `send(und...
Automatic OPTIONS response breaks with multiple routers
The router has automatic handling of OPTIONS based on the registered routes, but if you make an OPTIONS request for an endpoint that does not exist, then it will still return a 200 with nothing allowed. Instead, we can let the request move on down the middleware chain. This has two benefits: first, if the route was not defined and no other middleware handles it, it will return with a 404. Secondly, if multiple routers are used and a later one has the route or a custom OPTIONS defined, the first router will not respond incorrectly.
Json rendering can be handled by user tools or overridden in their own app to behave as desired. Minimizes the use of magic env settings.
Update to valid Jade Doctype
Value parameter of app.set() should be typed optional Object