express facebook verify subscription creation routes

gistfile1.js

    app.post('/facebook/realtimeupdates', function(req, res) {
        f = ':/facebook/realtimeupdates POST cb:';

        var object = req.param('object');
        var entry = req.param('entry');
        log.finer(__filename+f+'new notifications');
        log.finest(__filename+f+'object=('+object+')');
        log.finest(__filename+f+'entry=('+entry+')');

        res.send(200);
    });

    app.get('/facebook/realtimeupdates', function(req, res) {
        f = ':/facebook/realtimeupdates GET cb:';

        //TODO read and implement ff
        //The end point should first verify the verify_token value is what you passed to Facebook, then return the hub.challenge value. This verification technique prevents malicious apps from using the real-time feature as tool for distributed denial-of-service (DDoS) attacks.

        var mode = req.param('hub.mode'),
            challenge = req.param('hub.challenge'),
            verify_token = req.param('hub.verify_token');

        log.finer(__filename+f+'subscription verification called');
        log.finest(__filename+f+'mode=('+mode+')');
        log.finest(__filename+f+'challenge=('+challenge+')');
        log.finest(__filename+f+'verify_token=('+verify_token+')');

        res.write('challenge'); // "return" the challenge this way?
        res.end();
    });