refactor: use res.json or sendStatus for objects or empty body

[mantariksh]

Problem

Usage of res.send creates the risk of HTML injection attacks if not used with care. Using res.json is better practice.

Solution

This PR addresses the cases where changing from res.status to res.json or res.sendStatus should be risk-free.

When res.send is called with an object, it behaves the same way as if res.json is called, since Express just calls res.json internally. Moreover, when res.send is called with no argument, it is (almost) equivalent to calling res.sendStatus, since the client should not be doing anything with the empty response body. This PR addresses these two cases throughout the codebase by changing res.send to res.json or res.sendStatus as necessary.

[liangyuanruo]

lgtm!