Mailgun key shouldn't be included in a source file.

[mpickering]

In routes/users.js the mailgun key is visible.

I think this should be fetched from an environmental variable as otherwise anyone can use your account in order to send a very large amount of email.