diff --git a/src/apps.js b/src/apps.js
index 37a0a6f1c..fdd30cfda 100644
--- a/src/apps.js
+++ b/src/apps.js
@@ -2821,7 +2821,7 @@ async function updateBackup(app, backupId, data) {
     if (!backup) throw new BoxError(BoxError.NOT_FOUND, 'Backup not found');
     if (backup.identifier !== app.id) throw new BoxError(BoxError.NOT_FOUND, 'Backup not found'); // some other app's backup
 
-    await backups.update(backupId, data);
+    await backups.update(backup, data);
 }
 
 async function getBackupDownloadStream(app, backupId) {
diff --git a/src/backups.js b/src/backups.js
index 9d951970f..3dab2e3c0 100644
--- a/src/backups.js
+++ b/src/backups.js
@@ -118,8 +118,8 @@ function validateLabel(label) {
 }
 
 // this is called by REST API
-async function update(id, data) {
-    assert.strictEqual(typeof id, 'string');
+async function update(backup, data) {
+    assert.strictEqual(typeof backup, 'object');
     assert.strictEqual(typeof data, 'object');
 
     let error;
@@ -135,10 +135,7 @@ async function update(id, data) {
             values.push(data[p]);
         }
     }
-    values.push(id);
-
-    const backup = await get(id);
-    if (backup === null) throw new BoxError(BoxError.NOT_FOUND, 'Backup not found');
+    values.push(backup.id);
 
     const result = await database.query('UPDATE backups SET ' + fields.join(', ') + ' WHERE id = ?', values);
     if (result.affectedRows !== 1) throw new BoxError(BoxError.NOT_FOUND, 'Backup not found');
diff --git a/src/routes/backups.js b/src/routes/backups.js
index dd4de5587..9c3d60cb3 100644
--- a/src/routes/backups.js
+++ b/src/routes/backups.js
@@ -1,7 +1,10 @@
 'use strict';
 
 exports = module.exports = {
+    load,
+
     list,
+    get,
     update,
 };
 
@@ -12,6 +15,24 @@ const assert = require('assert'),
     HttpSuccess = require('@cloudron/connect-lastmile').HttpSuccess,
     safe = require('safetydance');
 
+async function load(req, res, next) {
+    assert.strictEqual(typeof req.params.id, 'string');
+
+    const [error, result] = await safe(backups.get(req.params.id));
+    if (error) return next(BoxError.toHttpError(error));
+    if (!result) return next(new HttpError(404, 'Backup not found'));
+
+    req.resources.backup = result;
+
+    next();
+}
+
+async function get(req, res, next) {
+    assert.strictEqual(typeof req.params.id, 'string');
+
+    next(new HttpSuccess(200,  req.resources.backup));
+}
+
 async function list(req, res, next) {
     const page = typeof req.query.page === 'string' ? parseInt(req.query.page) : 1;
     if (!page || page < 0) return next(new HttpError(400, 'page query param has to be a postive number'));
@@ -26,14 +47,13 @@ async function list(req, res, next) {
 }
 
 async function update(req, res, next) {
-    assert.strictEqual(typeof req.params.backupId, 'string');
     assert.strictEqual(typeof req.body, 'object');
 
     const { label, preserveSecs } = req.body;
     if (typeof label !== 'string') return next(new HttpError(400, 'label must be a string'));
     if (typeof preserveSecs !== 'number') return next(new HttpError(400, 'preserveSecs must be a number'));
 
-    const [error] = await safe(backups.update(req.params.backupId, { label, preserveSecs }));
+    const [error] = await safe(backups.update(req.resources.backup, { label, preserveSecs }));
     if (error) return next(BoxError.toHttpError(error));
 
     next(new HttpSuccess(200, {}));
diff --git a/src/routes/test/backups-test.js b/src/routes/test/backups-test.js
index 6e4ac5892..824a46acf 100644
--- a/src/routes/test/backups-test.js
+++ b/src/routes/test/backups-test.js
@@ -36,7 +36,7 @@ describe('Backups API', function () {
         const response = await superagent.get(`${serverUrl}/api/v1/backups/bad_id`)
             .query({ access_token: owner.token })
             .ok(() => true);
-        expect(response.status).to.equal(400);
+        expect(response.status).to.equal(404);
     });
 
     it('can get valid id', async function () {
diff --git a/src/routes/users.js b/src/routes/users.js
index ea4246b2b..26482e692 100644
--- a/src/routes/users.js
+++ b/src/routes/users.js
@@ -113,13 +113,10 @@ async function getAvatar(req, res, next) {
     assert.strictEqual(typeof req.resources.user, 'object');
     assert.strictEqual(typeof req.user, 'object');
 
-    console.log('HERE');
     const [avatarError, avatar] = await safe(users.getAvatar(req.resources.user));
     if (avatarError) return next(BoxError.toHttpError(avatarError));
     if (!avatar) return next(new HttpError(404, 'no avatar'));
 
-        console.log('GETT AVATAR TO', avatar.length, req.resources.user.id);
-
     res.set('Content-Type', 'image/png');
     res.status(200).send(avatar);
 }
@@ -133,8 +130,6 @@ async function setAvatar(req, res, next) {
     safe.fs.unlinkSync(req.files.avatar.path);
     if (!avatar) return next(BoxError.toHttpError(new BoxError(BoxError.FS_ERROR, safe.error.message)));
 
-    console.log('SETTING AVATAR TO', avatar.length, req.resources.user.id);
-
     const [error] = await safe(users.setAvatar(req.resources.user, avatar));
     if (error) return next(BoxError.toHttpError(error));
 
diff --git a/src/server.js b/src/server.js
index 4de3b3d4d..4840ce2c8 100644
--- a/src/server.js
+++ b/src/server.js
@@ -153,7 +153,8 @@ async function initializeExpressSync() {
 
     // backup routes
     router.get ('/api/v1/backups',                        token, authorizeAdmin, routes.backups.list);
-    router.post('/api/v1/backups/:backupId',        json, token, authorizeAdmin, routes.backups.update);
+    router.get ('/api/v1/backups/:id',                    token, authorizeAdmin, routes.backups.load, routes.backups.get);
+    router.post('/api/v1/backups/:id',              json, token, authorizeAdmin, routes.backups.load, routes.backups.update);
 
     // backup target (destination) routes
     router.get ('/api/v1/backup_targets/',                                token, authorizeAdmin, routes.backupTargets.list);
diff --git a/src/test/backups-test.js b/src/test/backups-test.js
index 3fad2b803..276bbfc48 100644
--- a/src/test/backups-test.js
+++ b/src/test/backups-test.js
@@ -7,7 +7,6 @@
 'use strict';
 
 const backups = require('../backups.js'),
-    backupTargets = require('../backuptargets.js'),
     BoxError = require('../boxerror.js'),
     common = require('./common.js'),
     expect = require('expect.js'),
@@ -87,7 +86,7 @@ describe('backups', function () {
         });
 
         it('update succeeds', async function () {
-            await backups.update(boxBackup.id, { label: 'DuMonde', preserveSecs: 30 });
+            await backups.update(boxBackup, { label: 'DuMonde', preserveSecs: 30 });
             const result = await backups.get(boxBackup.id);
             expect(result.label).to.eql('DuMonde');
             expect(result.preserveSecs).to.eql(30);