diff --git a/migrations/20180202184625-download-caas-appstore-configs.js b/migrations/20180202184625-download-caas-appstore-configs.js
index 6a4a4d018..5f5528dc9 100644
--- a/migrations/20180202184625-download-caas-appstore-configs.js
+++ b/migrations/20180202184625-download-caas-appstore-configs.js
@@ -1,45 +1,38 @@
 'use strict';
 
-var async = require('async'),
-    fs = require('fs'),
-    superagent = require('superagent');
+const fs = require('fs'),
+    superagent = require('../src/superagent.js');
 
-exports.up = function(db, callback) {
+exports.up = async function(db) {
     if (!fs.existsSync('/home/yellowtent/configs/cloudron.conf')) {
         console.log('Unable to locate cloudron.conf');
-        return callback();
+        return;
     }
 
-    var config = JSON.parse(fs.readFileSync('/home/yellowtent/configs/cloudron.conf', 'utf8'));
+    const config = JSON.parse(fs.readFileSync('/home/yellowtent/configs/cloudron.conf', 'utf8'));
 
     if (config.provider !== 'caas' || !config.fqdn) {
         console.log('Not caas (%s) or no fqdn', config.provider, config.fqdn);
-        return callback();
+        return;
     }
 
-    db.runSql('SELECT COUNT(*) AS total FROM users', function (error, result) {
-        if (error) return callback(error);
+    const result = await db.runSql('SELECT COUNT(*) AS total FROM users');
 
-        if (result[0].total === 0) {
-            console.log('This cloudron is not activated. It will automatically get appstore and caas configs from autoprovision logic');
-            return callback();
-        }
+    if (result[0].total === 0) {
+        console.log('This cloudron is not activated. It will automatically get appstore and caas configs from autoprovision logic');
+        return;
+    }
 
-        console.log('Downloading appstore and caas config');
+    console.log('Downloading appstore and caas config');
 
-        superagent.get(config.apiServerOrigin + `/api/v1/boxes/${config.fqdn}/config`)
-            .query({ token: config.token })
-            .timeout(30 * 1000).end(function (error, result) {
-                if (error) return callback(error);
+    const response = await superagent.get(config.apiServerOrigin + `/api/v1/boxes/${config.fqdn}/config`)
+        .query({ token: config.token })
+        .timeout(30 * 1000);
 
-                console.log('Adding %j config', result.body);
+    console.log('Adding %j config', response.body);
 
-                async.series([
-                    db.runSql.bind(db, 'INSERT settings (name, value) VALUES(?, ?)', [ 'appstore_config', JSON.stringify(result.body.appstoreConfig) ]),
-                    db.runSql.bind(db, 'INSERT settings (name, value) VALUES(?, ?)', [ 'caas_config', JSON.stringify(result.body.caasConfig) ])
-                ], callback);
-            });
-    });
+    await db.runSql('INSERT settings (name, value) VALUES(?, ?)', [ 'appstore_config', JSON.stringify(response.body.appstoreConfig) ]);
+    await db.runSql('INSERT settings (name, value) VALUES(?, ?)', [ 'caas_config', JSON.stringify(response.body.caasConfig) ]);
 };
 
 exports.down = function(db, callback) {
diff --git a/migrations/20190503170326-settings-get-license.js b/migrations/20190503170326-settings-get-license.js
index 42b97bba5..d1a67ef9e 100644
--- a/migrations/20190503170326-settings-get-license.js
+++ b/migrations/20190503170326-settings-get-license.js
@@ -1,49 +1,43 @@
 'use strict';
 
-var async = require('async'),
-    fs = require('fs'),
-    superagent = require('superagent');
+const fs = require('fs'),
+    superagent = require('../src/superagent.js');
 
-exports.up = function(db, callback) {
+exports.up = async function(db) {
     if (!fs.existsSync('/etc/cloudron/cloudron.conf')) {
         console.log('Unable to locate cloudron.conf');
-        return callback();
+        return;
     }
 
     const config = JSON.parse(fs.readFileSync('/etc/cloudron/cloudron.conf', 'utf8'));
 
-    db.all('SELECT * FROM settings WHERE name="appstore_config"', function (error, results) {
-        if (error) return callback(error);
+    const results = await db.all('SELECT * FROM settings WHERE name="appstore_config"');
 
-        if (results.length === 0) {
-            console.log('No appstore config, skipping license migration');
-            return callback();
-        }
+    if (results.length === 0) {
+        console.log('No appstore config, skipping license migration');
+        return;
+    }
 
-        console.log('Downloading license');
+    console.log('Downloading license');
 
-        const appstoreConfig = JSON.parse(results[0].value);
+    const appstoreConfig = JSON.parse(results[0].value);
 
-        superagent.get(`${config.apiServerOrigin}/api/v1/cloudron_license`)
+    const response = await superagent.get(`${config.apiServerOrigin}/api/v1/cloudron_license`)
             .query({ accessToken: appstoreConfig.token, cloudronId: appstoreConfig.cloudronId, provider: config.provider })
-            .timeout(30 * 1000).end(function (error, result) {
-                if (error && !error.response) return callback(new Error('Network error getting license:' + error.message));
-                if (result.statusCode !== 200) return callback(new Error(`Bad status getting license: ${result.status} ${result.text}`));
+            .timeout(30 * 1000);
 
-                if (!result.body.cloudronId || !result.body.licenseKey || !result.body.cloudronToken) return callback(new Error(`Bad response getting license:  ${result.text}`));
+    if (response.status !== 200) throw new Error(`Bad status getting license: ${response.status} ${response.text}`);
 
-                console.log('Adding license', result.body);
+    if (!response.body.cloudronId || !response.body.licenseKey || !response.body.cloudronToken) throw new Error(`Bad response getting license:  ${response.text}`);
 
-                async.series([
-                    db.runSql.bind(db, 'START TRANSACTION;'),
-                    db.runSql.bind(db, 'INSERT settings (name, value) VALUES(?, ?)', [ 'cloudron_id', result.body.cloudronId ]),
-                    db.runSql.bind(db, 'INSERT settings (name, value) VALUES(?, ?)', [ 'license_key', result.body.licenseKey ]),
-                    db.runSql.bind(db, 'INSERT settings (name, value) VALUES(?, ?)', [ 'cloudron_token', result.body.cloudronToken ]),
-                    db.runSql.bind(db, 'DELETE FROM settings WHERE name=?', [ 'appstore_config' ]),
-                    db.runSql.bind(db, 'COMMIT')
-                ], callback);
-            });
-    });
+    console.log('Adding license', response.body);
+
+    await db.runSql('START TRANSACTION;');
+    await db.runSql('INSERT settings (name, value) VALUES(?, ?)', [ 'cloudron_id', response.body.cloudronId ]);
+    await db.runSql('INSERT settings (name, value) VALUES(?, ?)', [ 'license_key', response.body.licenseKey ]);
+    await db.runSql('INSERT settings (name, value) VALUES(?, ?)', [ 'cloudron_token', response.body.cloudronToken ]);
+    await db.runSql('DELETE FROM settings WHERE name=?', [ 'appstore_config' ]);
+    await db.runSql('COMMIT');
 };
 
 exports.down = function(db, callback) {
diff --git a/migrations/20220401045439-settings-get-appstore-web-token.js b/migrations/20220401045439-settings-get-appstore-web-token.js
index 01c1ecff6..9b0983b92 100644
--- a/migrations/20220401045439-settings-get-appstore-web-token.js
+++ b/migrations/20220401045439-settings-get-appstore-web-token.js
@@ -1,35 +1,29 @@
 'use strict';
 
-const superagent = require('superagent');
+const superagent = require('../src/superagent.js');
 
-exports.up = function(db, callback) {
-    db.all('SELECT value FROM settings WHERE name="api_server_origin"', function (error, results) {
-        if (error || results.length === 0) return callback(error);
-        const apiServerOrigin = results[0].value;
+exports.up = async function(db) {
+    const results1 = await db.runSql('SELECT value FROM settings WHERE name="api_server_origin"');
+    if (results1.length === 0) return;
+    const apiServerOrigin = results1[0].value;
 
-        db.all('SELECT value FROM settings WHERE name="appstore_api_token"', function (error, results) {
-            if (error || results.length === 0) return callback(error);
-            const apiToken = results[0].value;
+    const results2 = await db.runSql('SELECT value FROM settings WHERE name="appstore_api_token"');
+    if (results2.length === 0) return;
+    const apiToken = results2[0].value;
 
-            console.log(`Getting appstore web token from ${apiServerOrigin}`);
+    console.log(`Getting appstore web token from ${apiServerOrigin}`);
 
-            superagent.post(`${apiServerOrigin}/api/v1/user_token`)
-                .send({})
-                .query({ accessToken: apiToken })
-                .timeout(30 * 1000).end(function (error, response) {
-                    if (error && !error.response) {
-                        console.log('Network error getting web token', error);
-                        return callback();
-                    }
-                    if (response.statusCode !== 201 || !response.body.accessToken) {
-                        console.log(`Bad status getting web token: ${response.status} ${response.text}`);
-                        return callback();
-                    }
+    const response = await superagent.post(`${apiServerOrigin}/api/v1/user_token`)
+        .send({})
+        .query({ accessToken: apiToken })
+        .timeout(30 * 1000);
 
-                    db.runSql('INSERT settings (name, value) VALUES(?, ?)', [ 'appstore_web_token', response.body.accessToken ], callback);
-                });
-        });
-    });
+    if (response.status !== 201 || !response.body.accessToken) {
+        console.log(`Bad status getting web token: ${response.status} ${response.text}`);
+        return;
+    }
+
+    await db.runSql('INSERT settings (name, value) VALUES(?, ?)', [ 'appstore_web_token', response.body.accessToken ]);
 };
 
 exports.down = function(db, callback) {
diff --git a/package-lock.json b/package-lock.json
index c675a22fc..f7f874478 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -45,13 +45,13 @@
         "oidc-provider": "^8.6.1",
         "ovh": "^2.0.3",
         "qrcode": "^1.5.4",
-        "safetydance": "^2.4.0",
+        "safetydance": "^2.5.0",
         "semver": "^7.7.1",
         "speakeasy": "^2.0.0",
-        "superagent": "10.1.1",
         "tar-stream": "^3.1.7",
         "tldjs": "^2.3.1",
         "ua-parser-js": "^2.0.2",
+        "undici": "^7.3.0",
         "uuid": "^11.0.5",
         "validator": "^13.12.0",
         "ws": "^8.18.0",
@@ -2847,12 +2847,6 @@
         "node": ">=8"
       }
     },
-    "node_modules/asap": {
-      "version": "2.0.6",
-      "resolved": "https://registry.npmjs.org/asap/-/asap-2.0.6.tgz",
-      "integrity": "sha512-BSHWgDSAiKs50o2Re8ppvp3seVHXSRM44cdSsT9FfNEUUZLOGWVCsiWaRPWM1Znn+mqZ1OfVZ3z3DWEzSp7hRA==",
-      "license": "MIT"
-    },
     "node_modules/asn1": {
       "version": "0.2.6",
       "resolved": "https://registry.npmjs.org/asn1/-/asn1-0.2.6.tgz",
@@ -3318,6 +3312,15 @@
         "validator": "^13.12.0"
       }
     },
+    "node_modules/cloudron-manifestformat/node_modules/safetydance": {
+      "version": "2.4.0",
+      "resolved": "https://registry.npmjs.org/safetydance/-/safetydance-2.4.0.tgz",
+      "integrity": "sha512-KsQJ5xpuv05yeLVMP6FTp8PNtj/iY5MxmirU2Bb6lf5EvKkZFr3Qrx9umV9/NrAvRfin8mhotJNAnBD3C3MUkw==",
+      "engines": [
+        "node >= 4.0.0"
+      ],
+      "license": "MIT"
+    },
     "node_modules/co": {
       "version": "4.6.0",
       "resolved": "https://registry.npmjs.org/co/-/co-4.6.0.tgz",
@@ -3368,10 +3371,6 @@
         "node": ">=18"
       }
     },
-    "node_modules/component-emitter": {
-      "version": "1.3.0",
-      "license": "MIT"
-    },
     "node_modules/concat-map": {
       "version": "0.0.1",
       "license": "MIT"
@@ -3544,11 +3543,6 @@
       "version": "1.0.6",
       "license": "MIT"
     },
-    "node_modules/cookiejar": {
-      "version": "2.1.4",
-      "resolved": "https://registry.npmjs.org/cookiejar/-/cookiejar-2.1.4.tgz",
-      "integrity": "sha512-LDx6oHrK+PhzLKJU9j5S7/Y3jM/mUHvD/DeI1WQmJn652iPC5Y4TBzC9l+5OMOXlyTTA+SmVUPm0HQUwpD5Jqw=="
-    },
     "node_modules/cookies": {
       "version": "0.9.1",
       "resolved": "https://registry.npmjs.org/cookies/-/cookies-0.9.1.tgz",
@@ -3909,16 +3903,6 @@
       ],
       "license": "MIT"
     },
-    "node_modules/dezalgo": {
-      "version": "1.0.4",
-      "resolved": "https://registry.npmjs.org/dezalgo/-/dezalgo-1.0.4.tgz",
-      "integrity": "sha512-rXSP0bf+5n0Qonsb+SVVfNfIsimO4HEtmnIpPHY8Q1UCzKlQrDMfdobr8nJOOsRgWCyMRqeSBQzmWUMq7zvVig==",
-      "license": "ISC",
-      "dependencies": {
-        "asap": "^2.0.0",
-        "wrappy": "1"
-      }
-    },
     "node_modules/diff": {
       "version": "5.2.0",
       "resolved": "https://registry.npmjs.org/diff/-/diff-5.2.0.tgz",
@@ -4719,10 +4703,6 @@
       "integrity": "sha512-DCXu6Ifhqcks7TZKY3Hxp3y6qphY5SJZmrWMDrKcERSOXWQdMhU9Ig/PYrzyw/ul9jOIyh0N4M0tbC5hodg8dw==",
       "dev": true
     },
-    "node_modules/fast-safe-stringify": {
-      "version": "2.1.1",
-      "license": "MIT"
-    },
     "node_modules/fast-xml-parser": {
       "version": "4.5.1",
       "resolved": "https://registry.npmjs.org/fast-xml-parser/-/fast-xml-parser-4.5.1.tgz",
@@ -4904,20 +4884,6 @@
         "node": ">= 14.17"
       }
     },
-    "node_modules/formidable": {
-      "version": "3.5.2",
-      "resolved": "https://registry.npmjs.org/formidable/-/formidable-3.5.2.tgz",
-      "integrity": "sha512-Jqc1btCy3QzRbJaICGwKcBfGWuLADRerLzDqi2NwSt/UkXLsHJw2TVResiaoBufHVHy9aSgClOHCeJsSsFLTbg==",
-      "license": "MIT",
-      "dependencies": {
-        "dezalgo": "^1.0.4",
-        "hexoid": "^2.0.0",
-        "once": "^1.4.0"
-      },
-      "funding": {
-        "url": "https://ko-fi.com/tunnckoCore/commissions"
-      }
-    },
     "node_modules/forwarded": {
       "version": "0.2.0",
       "license": "MIT",
@@ -5227,15 +5193,6 @@
         "he": "bin/he"
       }
     },
-    "node_modules/hexoid": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/hexoid/-/hexoid-2.0.0.tgz",
-      "integrity": "sha512-qlspKUK7IlSQv2o+5I7yhUd7TxlOG2Vr5LTa3ve2XSNVKAL/n/u/7KLvKmFNimomDIKvZFXWHv0T12mv7rT8Aw==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=8"
-      }
-    },
     "node_modules/html-encoding-sniffer": {
       "version": "4.0.0",
       "resolved": "https://registry.npmjs.org/html-encoding-sniffer/-/html-encoding-sniffer-4.0.0.tgz",
@@ -6081,17 +6038,6 @@
         "node": ">= 0.6"
       }
     },
-    "node_modules/mime": {
-      "version": "2.6.0",
-      "resolved": "https://registry.npmjs.org/mime/-/mime-2.6.0.tgz",
-      "integrity": "sha512-USPkMeET31rOMiarsBNIHZKLGgvKc/LrjofAnBlOttf5ajRvqiRA8QsenbcooctK6d6Ts6aqZXBA+XbkKthiQg==",
-      "bin": {
-        "mime": "cli.js"
-      },
-      "engines": {
-        "node": ">=4.0.0"
-      }
-    },
     "node_modules/mime-db": {
       "version": "1.52.0",
       "license": "MIT",
@@ -7360,12 +7306,13 @@
       "license": "MIT"
     },
     "node_modules/safetydance": {
-      "version": "2.4.0",
-      "resolved": "https://registry.npmjs.org/safetydance/-/safetydance-2.4.0.tgz",
-      "integrity": "sha512-KsQJ5xpuv05yeLVMP6FTp8PNtj/iY5MxmirU2Bb6lf5EvKkZFr3Qrx9umV9/NrAvRfin8mhotJNAnBD3C3MUkw==",
+      "version": "2.5.0",
+      "resolved": "https://registry.npmjs.org/safetydance/-/safetydance-2.5.0.tgz",
+      "integrity": "sha512-hXwJw13AvbhClD2XAreKcFSkGhiTlhARYdY+EOL6WAgJ6DfZkD4+GIMT3JmdJPZSm7hLD2zP3TGjRSiaBJwDtg==",
       "engines": [
         "node >= 4.0.0"
-      ]
+      ],
+      "license": "MIT"
     },
     "node_modules/sax": {
       "version": "1.2.1",
@@ -7864,26 +7811,6 @@
       "resolved": "https://registry.npmjs.org/stubs/-/stubs-3.0.0.tgz",
       "integrity": "sha512-PdHt7hHUJKxvTCgbKX9C1V/ftOcjJQgz8BZwNfV5c4B6dcGqlpelTbJ999jBGZ2jYiPAwcX5dP6oBwVlBlUbxw=="
     },
-    "node_modules/superagent": {
-      "version": "10.1.1",
-      "resolved": "https://registry.npmjs.org/superagent/-/superagent-10.1.1.tgz",
-      "integrity": "sha512-9pIwrHrOj3uAnqg9gDlW7EA2xv+N5au/dSM0kM22HTqmUu8jBxNT+8uA7tA3UoCnmiqzpSbu8rasIUZvbyamMQ==",
-      "license": "MIT",
-      "dependencies": {
-        "component-emitter": "^1.3.0",
-        "cookiejar": "^2.1.4",
-        "debug": "^4.3.4",
-        "fast-safe-stringify": "^2.1.1",
-        "form-data": "^4.0.0",
-        "formidable": "^3.5.2",
-        "methods": "^1.1.2",
-        "mime": "2.6.0",
-        "qs": "^6.11.0"
-      },
-      "engines": {
-        "node": ">=14.18.0"
-      }
-    },
     "node_modules/supports-color": {
       "version": "8.1.1",
       "dev": true,
@@ -8213,6 +8140,15 @@
         "node": ">= 0.8"
       }
     },
+    "node_modules/undici": {
+      "version": "7.3.0",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-7.3.0.tgz",
+      "integrity": "sha512-Qy96NND4Dou5jKoSJ2gm8ax8AJM/Ey9o9mz7KN1bb9GP+G0l20Zw8afxTnY2f4b7hmhn/z8aC2kfArVQlAhFBw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=20.18.1"
+      }
+    },
     "node_modules/undici-types": {
       "version": "5.26.5",
       "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-5.26.5.tgz",
diff --git a/package.json b/package.json
index 1e2782baa..49f0bf0dc 100644
--- a/package.json
+++ b/package.json
@@ -53,13 +53,13 @@
     "oidc-provider": "^8.6.1",
     "ovh": "^2.0.3",
     "qrcode": "^1.5.4",
-    "safetydance": "^2.4.0",
+    "safetydance": "^2.5.0",
     "semver": "^7.7.1",
     "speakeasy": "^2.0.0",
-    "superagent": "10.1.1",
     "tar-stream": "^3.1.7",
     "tldjs": "^2.3.1",
     "ua-parser-js": "^2.0.2",
+    "undici": "^7.3.0",
     "uuid": "^11.0.5",
     "validator": "^13.12.0",
     "ws": "^8.18.0",
diff --git a/src/acme2.js b/src/acme2.js
index ef4ff8c02..98a1d4d1e 100644
--- a/src/acme2.js
+++ b/src/acme2.js
@@ -21,7 +21,7 @@ const assert = require('assert'),
     promiseRetry = require('./promise-retry.js'),
     safe = require('safetydance'),
     shell = require('./shell.js')('acme2'),
-    superagent = require('superagent'),
+    superagent = require('./superagent.js'),
     users = require('./users.js');
 
 const CA_PROD_DIRECTORY_URL = 'https://acme-v02.api.letsencrypt.org/directory',
@@ -147,7 +147,7 @@ Acme2.prototype.updateContact = async function (registrationUri) {
     };
 
     const result = await this.sendSignedRequest(registrationUri, JSON.stringify(payload));
-    if (result.status !== 200) throw new BoxError(BoxError.ACME_ERROR, `Failed to update contact. Expecting 200, got ${result.status} ${JSON.stringify(result.body)}`);
+    if (result.status !== 200) throw new BoxError(BoxError.ACME_ERROR, `Failed to update contact. Expecting 200, got ${result.status} ${result.text}`);
 
     debug(`updateContact: contact of user updated to ${this.email}`);
 };
@@ -173,14 +173,14 @@ Acme2.prototype.ensureAccount = async function () {
 
     let result = await this.sendSignedRequest(this.directory.newAccount, JSON.stringify(payload));
     if (result.status === 403 && result.body.type === 'urn:ietf:params:acme:error:unauthorized') {
-        debug(`ensureAccount: key was revoked. ${result.status} ${JSON.stringify(result.body)}. generating new account key`);
+        debug(`ensureAccount: key was revoked. ${result.status} ${result.text}. generating new account key`);
         this.accountKey = await generateAccountKey();
         await blobs.setString(blobs.ACME_ACCOUNT_KEY, this.accountKey);
         result = await this.sendSignedRequest(this.directory.newAccount, JSON.stringify(payload));
     }
 
     // 200 if already exists. 201 for new accounts
-    if (result.status !== 200 && result.status !== 201) throw new BoxError(BoxError.ACME_ERROR, `Failed to register new account. Expecting 200 or 201, got ${result.status} ${JSON.stringify(result.body)}`);
+    if (result.status !== 200 && result.status !== 201) throw new BoxError(BoxError.ACME_ERROR, `Failed to register new account. Expecting 200 or 201, got ${result.status} ${result.text}`);
 
     debug(`ensureAccount: user registered keyid: ${result.headers.location}`);
 
@@ -202,10 +202,10 @@ Acme2.prototype.newOrder = async function () {
 
     const result = await this.sendSignedRequest(this.directory.newOrder, JSON.stringify(payload));
     if (result.status === 403) throw new BoxError(BoxError.ACCESS_DENIED, `Forbidden sending new order: ${result.body.detail}`);
-    if (result.status !== 201) throw new BoxError(BoxError.ACME_ERROR, `Failed to send new order. Expecting 201, got ${result.statusCode} ${JSON.stringify(result.body)}`);
+    if (result.status !== 201) throw new BoxError(BoxError.ACME_ERROR, `Failed to send new order. Expecting 201, got ${result.status} ${result.text}`);
 
     const order = result.body, orderUrl = result.headers.location;
-    debug(`newOrder: created order ${this.cn} order: ${JSON.stringify(result.body)} orderUrl: ${orderUrl}`);
+    debug(`newOrder: created order ${this.cn} order: ${result.text} orderUrl: ${orderUrl}`);
 
     if (!Array.isArray(order.authorizations)) throw new BoxError(BoxError.ACME_ERROR, 'invalid authorizations in order');
     if (typeof order.finalize !== 'string') throw new BoxError(BoxError.ACME_ERROR, 'invalid finalize in order');
@@ -232,7 +232,7 @@ Acme2.prototype.waitForOrder = async function (orderUrl) {
 
         if (result.body.status === 'pending' || result.body.status === 'processing') throw new BoxError(BoxError.ACME_ERROR, `Request is in ${result.body.status} state`);
         else if (result.body.status === 'valid' && result.body.certificate) return result.body.certificate;
-        else throw new BoxError(BoxError.ACME_ERROR, `Unexpected status or invalid response when waiting for order: ${JSON.stringify(result.body)}`);
+        else throw new BoxError(BoxError.ACME_ERROR, `Unexpected status or invalid response when waiting for order: ${result.text}`);
     });
 };
 
@@ -264,7 +264,7 @@ Acme2.prototype.notifyChallengeReady = async function (challenge) {
     };
 
     const result = await this.sendSignedRequest(challenge.url, JSON.stringify(payload));
-    if (result.status !== 200) throw new BoxError(BoxError.ACME_ERROR, `Failed to notify challenge. Expecting 200, got ${result.statusCode} ${JSON.stringify(result.body)}`);
+    if (result.status !== 200) throw new BoxError(BoxError.ACME_ERROR, `Failed to notify challenge. Expecting 200, got ${result.status} ${result.text}`);
 };
 
 Acme2.prototype.waitForChallenge = async function (challenge) {
@@ -281,7 +281,7 @@ Acme2.prototype.waitForChallenge = async function (challenge) {
             throw new BoxError(BoxError.ACME_ERROR, `Bad response code when waiting for challenge : ${result.status}`);
         }
 
-        debug(`waitForChallenge: status is "${result.body.status}" "${JSON.stringify(result.body)}"`);
+        debug(`waitForChallenge: status is "${result.body.status}" "${result.text}"`);
 
         if (result.body.status === 'pending') throw new BoxError(BoxError.ACME_ERROR, 'Challenge is in pending state');
         else if (result.body.status === 'valid') return;
@@ -304,7 +304,7 @@ Acme2.prototype.signCertificate = async function (finalizationUrl, csrPem) {
 
     const result = await this.sendSignedRequest(finalizationUrl, JSON.stringify(payload));
     // 429 means we reached the cert limit for this domain
-    if (result.status !== 200) throw new BoxError(BoxError.ACME_ERROR, `Failed to sign certificate. Expecting 200, got ${result.status} ${JSON.stringify(result.body)}`);
+    if (result.status !== 200) throw new BoxError(BoxError.ACME_ERROR, `Failed to sign certificate. Expecting 200, got ${result.status} ${result.text}`);
 };
 
 Acme2.prototype.ensureKey = async function () {
@@ -357,8 +357,8 @@ Acme2.prototype.downloadCertificate = async function (certUrl) {
         debug(`downloadCertificate: downloading certificate of ${this.cn}`);
 
         const result = await this.postAsGet(certUrl);
-        if (result.statusCode === 202) throw new BoxError(BoxError.ACME_ERROR, 'Retry downloading certificate');
-        if (result.statusCode !== 200) throw new BoxError(BoxError.ACME_ERROR, `Failed to get cert. Expecting 200, got ${result.statusCode} ${JSON.stringify(result.body)}`);
+        if (result.status === 202) throw new BoxError(BoxError.ACME_ERROR, 'Retry downloading certificate');
+        if (result.status !== 200) throw new BoxError(BoxError.ACME_ERROR, `Failed to get cert. Expecting 200, got ${result.status} ${result.text}`);
 
         const fullChainPem = result.body.toString('utf8'); // buffer
         return fullChainPem;
@@ -508,7 +508,7 @@ Acme2.prototype.loadDirectory = async function () {
 
         if (typeof response.body.newNonce !== 'string' ||
             typeof response.body.newOrder !== 'string' ||
-            typeof response.body.newAccount !== 'string') throw new BoxError(BoxError.ACME_ERROR, `Invalid response body : ${response.body}`);
+            typeof response.body.newAccount !== 'string') throw new BoxError(BoxError.ACME_ERROR, `Invalid response body : ${response.text}`);
 
         this.directory = response.body;
     });
diff --git a/src/apphealthmonitor.js b/src/apphealthmonitor.js
index dab80ebca..b56e0f92b 100644
--- a/src/apphealthmonitor.js
+++ b/src/apphealthmonitor.js
@@ -9,7 +9,7 @@ const apps = require('./apps.js'),
     docker = require('./docker.js'),
     eventlog = require('./eventlog.js'),
     safe = require('safetydance'),
-    superagent = require('superagent');
+    superagent = require('./superagent.js');
 
 exports = module.exports = {
     run
diff --git a/src/applinks.js b/src/applinks.js
index aab5c82ff..c80746770 100644
--- a/src/applinks.js
+++ b/src/applinks.js
@@ -16,7 +16,7 @@ const assert = require('assert'),
     debug = require('debug')('box:applinks'),
     jsdom = require('jsdom'),
     safe = require('safetydance'),
-    superagent = require('superagent'),
+    superagent = require('./superagent.js'),
     uuid = require('uuid');
 
 const APPLINKS_FIELDS= [ 'id', 'accessRestrictionJson', 'creationTime', 'updateTime', 'ts', 'label', 'tagsJson', 'icon', 'upstreamUri' ].join(',');
@@ -90,15 +90,12 @@ async function listByUser(user) {
 async function detectMetaInfo(upstreamUri) {
     assert.strictEqual(typeof upstreamUri, 'string');
 
-    const [error, response] = await safe(superagent.get(upstreamUri).set('User-Agent', 'Mozilla').timeout(10*1000));
-    if (error || !response.text) {
-        debug('detectMetaInfo: Unable to fetch upstreamUri to detect icon and title', error.statusCode);
+    const [upstreamError, upstreamRespose] = await safe(superagent.get(upstreamUri).set('User-Agent', 'Mozilla').timeout(10*1000));
+    if (upstreamError) {
+        debug(`detectMetaInfo: error fetching ${upstreamUri}: ${upstreamError.status}`);
         return null;
     }
 
-    // set redirected URI if any for favicon url
-    const redirectUri = (response.redirects && response.redirects.length) ? response.redirects[0] : null;
-
     const virtualConsole = new jsdom.VirtualConsole();
     virtualConsole.on('error', () => {
       // No-op to skip console errors.
@@ -134,14 +131,14 @@ async function detectMetaInfo(upstreamUri) {
     if (!favicon && dom.window.document.querySelector('meta[itemprop="image"]')) favicon = dom.window.document.querySelector('meta[itemprop="image"]').content;
 
     if (favicon) {
-        favicon = new URL(favicon, redirectUri || upstreamUri).toString();
+        favicon = new URL(favicon, upstreamRespose.url).toString();
 
         debug(`detectMetaInfo: found icon: ${favicon}`);
 
         const [error, response] = await safe(superagent.get(favicon).timeout(10*1000));
-        if (error) debug(`Failed to fetch icon ${favicon}: `, error);
-        else if (response.ok && response.headers['content-type'].indexOf('image') !== -1) icon = response.body || response.text;
-        else debug(`Failed to fetch icon ${favicon}: statusCode=${response.status}`);
+        if (error) debug(`Failed to fetch icon ${favicon}: ${error.message} ${error.status}`);
+        else if (response.headers['content-type']?.indexOf('image') !== -1) icon = response.body || response.text;
+        else debug(`Failed to fetch icon ${favicon}: status=${response.status}`);
     }
 
     if (!favicon) {
@@ -149,8 +146,8 @@ async function detectMetaInfo(upstreamUri) {
 
         const [error, response] = await safe(superagent.get(`${upstreamUri}/favicon.ico`).timeout(10*1000));
         if (error) debug(`Failed to fetch icon ${favicon}: `, error);
-        else if (response.ok && response.headers['content-type'].indexOf('image') !== -1) icon = response.body || response.text;
-        else debug(`Failed to fetch icon ${favicon}: statusCode=${response.status} content type ${response.headers['content-type']}`);
+        else if (response.headers['content-type']?.indexOf('image') !== -1) icon = response.body || response.text;
+        else debug(`Failed to fetch icon ${favicon}: status=${response.status} content type ${response.headers['content-type']}`);
     }
 
     // detect label
diff --git a/src/appstore.js b/src/appstore.js
index fea0b28e7..982fa4ca1 100644
--- a/src/appstore.js
+++ b/src/appstore.js
@@ -49,7 +49,7 @@ const apps = require('./apps.js'),
     semver = require('semver'),
     settings = require('./settings.js'),
     shell = require('./shell.js')('appstore'),
-    superagent = require('superagent'),
+    superagent = require('./superagent.js'),
     support = require('./support.js');
 
 // These are the default options and will be adjusted once a subscription state is obtained
@@ -298,7 +298,7 @@ async function registerCloudron(data) {
 
     if (error) throw new BoxError(BoxError.NETWORK_ERROR, error);
     if (response.status === 401) throw new BoxError(BoxError.LICENSE_ERROR, 'Setup token invalid');
-    if (response.status !== 201) throw new BoxError(BoxError.EXTERNAL_ERROR, `Unable to register cloudron: ${response.statusCode} ${error.message}`);
+    if (response.status !== 201) throw new BoxError(BoxError.EXTERNAL_ERROR, `Unable to register cloudron: ${response.status} ${error.message}`);
 
     if (!response.body.cloudronId) throw new BoxError(BoxError.EXTERNAL_ERROR, 'Invalid response - no cloudron id');
     if (!response.body.cloudronToken) throw new BoxError(BoxError.EXTERNAL_ERROR, 'Invalid response - no token');
@@ -468,7 +468,7 @@ async function getAppVersion(appId, version) {
         .ok(() => true));
 
     if (error) throw new BoxError(BoxError.NETWORK_ERROR, error);
-    if (response.status === 403 || response.statusCode === 401) throw new BoxError(BoxError.INVALID_CREDENTIALS, 'Invalid appstore token');
+    if (response.status === 403 || response.status === 401) throw new BoxError(BoxError.INVALID_CREDENTIALS, 'Invalid appstore token');
     if (response.status === 404) throw new BoxError(BoxError.NOT_FOUND, `Could not find app ${appId}`);
     if (response.status !== 200) throw new BoxError(BoxError.EXTERNAL_ERROR, `App fetch failed. ${response.status} ${JSON.stringify(response.body)}`);
 
@@ -486,7 +486,6 @@ async function downloadIcon(appStoreId, version) {
 
     return await promiseRetry({ times: 10, interval: 5000, debug }, async function () {
         const [networkError, response] = await safe(superagent.get(iconUrl)
-            .buffer(true)
             .timeout(60 * 1000)
             .ok(() => true));
 
diff --git a/src/dns/bunny.js b/src/dns/bunny.js
index b0888688e..33c763146 100644
--- a/src/dns/bunny.js
+++ b/src/dns/bunny.js
@@ -17,7 +17,7 @@ const assert = require('assert'),
     dig = require('../dig.js'),
     dns = require('../dns.js'),
     safe = require('safetydance'),
-    superagent = require('superagent'),
+    superagent = require('../superagent.js'),
     waitForDns = require('./waitfordns.js');
 
 const BUNNY_API = 'https://api.bunny.net';
@@ -32,7 +32,7 @@ function recordTypeToInt(value) {
 }
 
 function formatError(response) {
-    return `Bunny DNS error ${response.statusCode} ${JSON.stringify(response.body)}`;
+    return `Bunny DNS error ${response.status} ${response.text}`;
 }
 
 function removePrivateFields(domainObject) {
@@ -54,10 +54,10 @@ async function getZoneId(domainConfig, zoneName) {
         .timeout(30 * 1000)
         .ok(() => true));
     if (error) throw new BoxError(BoxError.NETWORK_ERROR, error);
-    if (response.statusCode === 401) throw new BoxError(BoxError.ACCESS_DENIED, formatError(response));
-    if (response.statusCode !== 200) throw new BoxError(BoxError.EXTERNAL_ERROR, formatError(response));
+    if (response.status === 401) throw new BoxError(BoxError.ACCESS_DENIED, formatError(response));
+    if (response.status !== 200) throw new BoxError(BoxError.EXTERNAL_ERROR, formatError(response));
 
-    if (!Array.isArray(response.body.Items)) throw new BoxError(BoxError.EXTERNAL_ERROR, `Invalid records in response: ${JSON.stringify(response.body)}`);
+    if (!Array.isArray(response.body.Items)) throw new BoxError(BoxError.EXTERNAL_ERROR, `Invalid records in response: ${response.text}`);
     const item = response.body.Items.filter(item => item.Domain === zoneName);
     if (item.length === 0) throw new BoxError(BoxError.NOT_FOUND, 'Domain not found');
 
@@ -79,9 +79,9 @@ async function getDnsRecords(domainConfig, zoneName, name, type) {
         .timeout(30 * 1000)
         .ok(() => true));
     if (error) throw new BoxError(BoxError.NETWORK_ERROR, error);
-    if (response.statusCode === 401) throw new BoxError(BoxError.ACCESS_DENIED, formatError(response));
-    if (response.statusCode !== 200) throw new BoxError(BoxError.EXTERNAL_ERROR, formatError(response));
-    if (!Array.isArray(response.body.Records)) throw new BoxError(BoxError.EXTERNAL_ERROR, `Invalid records in response: ${JSON.stringify(response.body)}`);
+    if (response.status === 401) throw new BoxError(BoxError.ACCESS_DENIED, formatError(response));
+    if (response.status !== 200) throw new BoxError(BoxError.EXTERNAL_ERROR, formatError(response));
+    if (!Array.isArray(response.body.Records)) throw new BoxError(BoxError.EXTERNAL_ERROR, `Invalid records in response: ${response.text}`);
 
     return response.body.Records.filter(r => recordTypeToString(r.Type) === type && r.Name === name);
 }
@@ -102,7 +102,8 @@ async function upsert(domainObject, location, type, values) {
     const records = await getDnsRecords(domainConfig, zoneName, name, type);
 
     // used to track available records to update instead of create
-    let i = 0, recordIds = [];
+    let i = 0;
+    const recordIds = [];
 
     for (let value of values) {
         let priority = 0;
@@ -130,8 +131,8 @@ async function upsert(domainObject, location, type, values) {
                 .timeout(30 * 1000)
                 .ok(() => true));
             if (error) throw new BoxError(BoxError.NETWORK_ERROR, error);
-            if (response.statusCode === 401) throw new BoxError(BoxError.ACCESS_DENIED, formatError(response));
-            if (response.statusCode !== 201) throw new BoxError(BoxError.EXTERNAL_ERROR, formatError(response));
+            if (response.status === 401) throw new BoxError(BoxError.ACCESS_DENIED, formatError(response));
+            if (response.status !== 201) throw new BoxError(BoxError.EXTERNAL_ERROR, formatError(response));
         } else {
             const [error, response] = await safe(superagent.post(`${BUNNY_API}/dnszone/${zoneId}/records/${records[i].Id}`)
                 .set('AccessKey', domainConfig.accessKey)
@@ -142,8 +143,8 @@ async function upsert(domainObject, location, type, values) {
             ++i;
 
             if (error) throw new BoxError(BoxError.NETWORK_ERROR, error);
-            if (response.statusCode === 401) throw new BoxError(BoxError.ACCESS_DENIED, formatError(response));
-            if (response.statusCode !== 204) throw new BoxError(BoxError.EXTERNAL_ERROR, formatError(response));
+            if (response.status === 401) throw new BoxError(BoxError.ACCESS_DENIED, formatError(response));
+            if (response.status !== 204) throw new BoxError(BoxError.EXTERNAL_ERROR, formatError(response));
 
             recordIds.push(safe.query(records.body, 'domain_record.id'));
         }
@@ -199,9 +200,9 @@ async function del(domainObject, location, type, values) {
             .ok(() => true));
 
         if (error) throw new BoxError(BoxError.NETWORK_ERROR, error);
-        if (response.statusCode === 401) throw new BoxError(BoxError.ACCESS_DENIED, formatError(response));
-        if (response.statusCode === 400) continue;
-        if (response.statusCode !== 204) throw new BoxError(BoxError.EXTERNAL_ERROR, formatError(response));
+        if (response.status === 401) throw new BoxError(BoxError.ACCESS_DENIED, formatError(response));
+        if (response.status === 400) continue;
+        if (response.status !== 204) throw new BoxError(BoxError.EXTERNAL_ERROR, formatError(response));
     }
 }
 
diff --git a/src/dns/cloudflare.js b/src/dns/cloudflare.js
index ab41b4a44..3eb8c2c44 100644
--- a/src/dns/cloudflare.js
+++ b/src/dns/cloudflare.js
@@ -18,7 +18,7 @@ const assert = require('assert'),
     dns = require('../dns.js'),
     ipaddr = require('ipaddr.js'),
     safe = require('safetydance'),
-    superagent = require('superagent'),
+    superagent = require('../superagent.js'),
     waitForDns = require('./waitfordns.js'),
     _ = require('../underscore.js');
 
@@ -34,23 +34,23 @@ function injectPrivateFields(newConfig, currentConfig) {
     if (newConfig.token === constants.SECRET_PLACEHOLDER) newConfig.token = currentConfig.token;
 }
 
-function translateRequestError(result) {
-    assert.strictEqual(typeof result, 'object');
+function translateResponseError(response) {
+    assert.strictEqual(typeof response, 'object');
 
-    if (result.statusCode === 404) return new BoxError(BoxError.NOT_FOUND, `[${result.statusCode}] ${JSON.stringify(result.body)}`);
-    if (result.statusCode === 422) return new BoxError(BoxError.BAD_FIELD, result.body.message);
-    if (result.statusCode === 400 || result.statusCode === 401 || result.statusCode === 403) {
+    if (response.status === 404) return new BoxError(BoxError.NOT_FOUND, `[${response.status}] ${response.text}`);
+    if (response.status === 422) return new BoxError(BoxError.BAD_FIELD, response.body.message);
+    if (response.status === 400 || response.status === 401 || response.status === 403) {
         let message = 'Unknown error';
-        if (typeof result.body.error === 'string') {
-            message = `[${result.statusCode}] ${result.body.error}`;
-        } else if (Array.isArray(result.body.errors) && result.body.errors.length > 0) {
-            const error = result.body.errors[0];
-            message = `[${result.statusCode}] ${error.message} code:${error.code}`;
+        if (typeof response.body.error === 'string') {
+            message = `[${response.status}] ${response.body.error}`;
+        } else if (Array.isArray(response.body.errors) && response.body.errors.length > 0) {
+            const error = response.body.errors[0];
+            message = `[${response.status}] ${error.message} code:${error.code}`;
         }
         return new BoxError(BoxError.ACCESS_DENIED, message);
     }
 
-    return new BoxError(BoxError.EXTERNAL_ERROR, `${result.statusCode} ${JSON.stringify(result.body)}`);
+    return new BoxError(BoxError.EXTERNAL_ERROR, `${response.status} ${response.text}`);
 }
 
 function createRequest(method, url, domainConfig) {
@@ -58,7 +58,7 @@ function createRequest(method, url, domainConfig) {
     assert.strictEqual(typeof url, 'string');
     assert.strictEqual(typeof domainConfig, 'object');
 
-    const request = superagent(method, url).timeout(30 * 1000).ok(() => true);
+    const request = superagent.request(method, url).timeout(30 * 1000).ok(() => true);
 
     if (domainConfig.tokenType === 'GlobalApiKey') {
         request.set('X-Auth-Key', domainConfig.token).set('X-Auth-Email', domainConfig.email);
@@ -75,15 +75,15 @@ async function getZoneByName(domainConfig, zoneName) {
 
     const [error, response] = await safe(createRequest('GET', `${CLOUDFLARE_ENDPOINT}/zones?name=${zoneName}&status=active`, domainConfig));
     if (error) throw new BoxError(BoxError.NETWORK_ERROR, error);
-    if (response.statusCode !== 200 || response.body.success !== true) throw translateRequestError(response);
-    if (!response.body.result || !response.body.result.length) throw new BoxError(BoxError.NOT_FOUND, `${response.statusCode} ${response.text}`);
+    if (response.status !== 200 || response.body.success !== true) throw translateResponseError(response);
+    if (!response.body.result || !response.body.result.length) throw new BoxError(BoxError.NOT_FOUND, `${response.status} ${response.text}`);
 
     // check 'id' and 'name_servers' exist in the response
     const zone = response.body.result[0];
     const zoneId = safe.query(zone, 'id');
-    if (typeof zoneId !== 'string') throw new BoxError(BoxError.EXTERNAL_ERROR, `No zone id in response: ${response.statusCode} ${response.text}`);
+    if (typeof zoneId !== 'string') throw new BoxError(BoxError.EXTERNAL_ERROR, `No zone id in response: ${response.status} ${response.text}`);
     const name_servers = safe.query(zone, 'name_servers');
-    if (!Array.isArray(name_servers)) throw new BoxError(BoxError.EXTERNAL_ERROR, `name_servers is not an array: ${response.statusCode} ${response.text}`);
+    if (!Array.isArray(name_servers)) throw new BoxError(BoxError.EXTERNAL_ERROR, `name_servers is not an array: ${response.status} ${response.text}`);
 
     return zone;
 }
@@ -99,11 +99,11 @@ async function getDnsRecords(domainConfig, zoneId, fqdn, type) {
         .query({ type: type, name: fqdn }));
 
     if (error) throw new BoxError(BoxError.NETWORK_ERROR, error);
-    if (response.statusCode !== 200 || response.body.success !== true) throw translateRequestError(response);
+    if (response.status !== 200 || response.body.success !== true) throw translateResponseError(response);
 
     const result = response.body.result;
     if (result === null) return []; // sometime about now, cloudflare API has started returning null instead of empty array
-    if (!Array.isArray(result)) throw new BoxError(BoxError.EXTERNAL_ERROR, `result is not an array when getting records: ${response.statusCode} ${response.text}`);
+    if (!Array.isArray(result)) throw new BoxError(BoxError.EXTERNAL_ERROR, `result is not an array when getting records: ${response.status} ${response.text}`);
     return result;
 }
 
@@ -155,7 +155,7 @@ async function upsert(domainObject, location, type, values) {
             const [error, response] = await safe(createRequest('POST', `${CLOUDFLARE_ENDPOINT}/zones/${zoneId}/dns_records`, domainConfig)
                 .send(data));
             if (error) throw new BoxError(BoxError.NETWORK_ERROR, error);
-            if (response.statusCode !== 200 || response.body.success !== true) throw translateRequestError(response);
+            if (response.status !== 200 || response.body.success !== true) throw translateResponseError(response);
         } else { // replace existing record
             data.proxied = records[i].proxied; // preserve proxied parameter
 
@@ -164,7 +164,7 @@ async function upsert(domainObject, location, type, values) {
             const [error, response] = await safe(createRequest('PUT', `${CLOUDFLARE_ENDPOINT}/zones/${zoneId}/dns_records/${records[i].id}`, domainConfig)
                 .send(data));
             if (error) throw new BoxError(BoxError.NETWORK_ERROR, error);
-            if (response.statusCode !== 200 || response.body.success !== true) throw translateRequestError(response);
+            if (response.status !== 200 || response.body.success !== true) throw translateResponseError(response);
             ++i; // increment, as we have consumed the record
         }
     }
@@ -214,7 +214,7 @@ async function del(domainObject, location, type, values) {
     for (const r of tmp) {
         const [error, response] = await safe(createRequest('DELETE', `${CLOUDFLARE_ENDPOINT}/zones/${zone.id}/dns_records/${r.id}`, domainConfig));
         if (error) throw new BoxError(BoxError.NETWORK_ERROR, error);
-        if (response.statusCode !== 200 || response.body.success !== true) throw translateRequestError(response);
+        if (response.status !== 200 || response.body.success !== true) throw translateResponseError(response);
     }
 }
 
diff --git a/src/dns/desec.js b/src/dns/desec.js
index c62b34c63..d06fa4217 100644
--- a/src/dns/desec.js
+++ b/src/dns/desec.js
@@ -18,13 +18,13 @@ const assert = require('assert'),
     dns = require('../dns.js'),
     safe = require('safetydance'),
     timers = require('timers/promises'),
-    superagent = require('superagent'),
+    superagent = require('../superagent.js'),
     waitForDns = require('./waitfordns.js');
 
 const DESEC_ENDPOINT = 'https://desec.io/api/v1';
 
 function formatError(response) {
-    return `deSEC DNS error [${response.statusCode}] ${JSON.stringify(response.body)}`;
+    return `deSEC DNS error [${response.status}] ${response.text}`;
 }
 
 function removePrivateFields(domainObject) {
@@ -54,9 +54,9 @@ async function get(domainObject, location, type) {
         .ok(() => true));
 
     if (error) throw new BoxError(BoxError.NETWORK_ERROR, error);
-    if (response.statusCode === 404) return [];
-    if (response.statusCode === 403 || response.statusCode === 401) throw new BoxError(BoxError.ACCESS_DENIED, formatError(response));
-    if (response.statusCode !== 200) throw new BoxError(BoxError.EXTERNAL_ERROR, formatError(response));
+    if (response.status === 404) return [];
+    if (response.status === 403 || response.status === 401) throw new BoxError(BoxError.ACCESS_DENIED, formatError(response));
+    if (response.status !== 200) throw new BoxError(BoxError.EXTERNAL_ERROR, formatError(response));
     if (!Array.isArray(response.body.records)) throw new BoxError(BoxError.EXTERNAL_ERROR, formatError(response));
 
     return response.body.records;
@@ -90,8 +90,8 @@ async function upsert(domainObject, location, type, values) {
         .ok(() => true));
 
     if (error) throw new BoxError(BoxError.NETWORK_ERROR, error);
-    if (response.statusCode === 403 || response.statusCode === 401) throw new BoxError(BoxError.ACCESS_DENIED, formatError(response));
-    if (response.statusCode !== 201) throw new BoxError(BoxError.EXTERNAL_ERROR, formatError(response));
+    if (response.status === 403 || response.status === 401) throw new BoxError(BoxError.ACCESS_DENIED, formatError(response));
+    if (response.status !== 201) throw new BoxError(BoxError.EXTERNAL_ERROR, formatError(response));
 }
 
 async function del(domainObject, location, type, values) {
@@ -112,9 +112,9 @@ async function del(domainObject, location, type, values) {
         .ok(() => true));
 
     if (error) throw new BoxError(BoxError.NETWORK_ERROR, error);
-    if (response.statusCode === 404) return;
-    if (response.statusCode === 403 || response.statusCode === 401) throw new BoxError(BoxError.ACCESS_DENIED, formatError(response));
-    if (response.statusCode !== 204) throw new BoxError(BoxError.EXTERNAL_ERROR, formatError(response));
+    if (response.status === 404) return;
+    if (response.status === 403 || response.status === 401) throw new BoxError(BoxError.ACCESS_DENIED, formatError(response));
+    if (response.status !== 204) throw new BoxError(BoxError.EXTERNAL_ERROR, formatError(response));
 }
 
 async function wait(domainObject, subdomain, type, value, options) {
diff --git a/src/dns/digitalocean.js b/src/dns/digitalocean.js
index 3f4753457..2e6d6490b 100644
--- a/src/dns/digitalocean.js
+++ b/src/dns/digitalocean.js
@@ -17,13 +17,13 @@ const assert = require('assert'),
     dig = require('../dig.js'),
     dns = require('../dns.js'),
     safe = require('safetydance'),
-    superagent = require('superagent'),
+    superagent = require('../superagent.js'),
     waitForDns = require('./waitfordns.js');
 
 const DIGITALOCEAN_ENDPOINT = 'https://api.digitalocean.com';
 
 function formatError(response) {
-    return `DigitalOcean DNS error ${response.statusCode} ${JSON.stringify(response.body)}`;
+    return `DigitalOcean DNS error ${response.status} ${response.text}`;
 }
 
 function removePrivateFields(domainObject) {
@@ -55,9 +55,9 @@ async function getZoneRecords(domainConfig, zoneName, name, type) {
             .ok(() => true));
 
         if (error) throw new BoxError(BoxError.NETWORK_ERROR, error);
-        if (response.statusCode === 404) throw new BoxError(BoxError.NOT_FOUND, formatError(response));
-        if (response.statusCode === 403 || response.statusCode === 401) throw new BoxError(BoxError.ACCESS_DENIED, formatError(response));
-        if (response.statusCode !== 200) throw new BoxError(BoxError.EXTERNAL_ERROR, formatError(response));
+        if (response.status === 404) throw new BoxError(BoxError.NOT_FOUND, formatError(response));
+        if (response.status === 403 || response.status === 401) throw new BoxError(BoxError.ACCESS_DENIED, formatError(response));
+        if (response.status !== 200) throw new BoxError(BoxError.EXTERNAL_ERROR, formatError(response));
 
         matchingRecords = matchingRecords.concat(response.body.domain_records.filter(function (record) {
             return (record.type === type && record.name === name);
@@ -114,9 +114,9 @@ async function upsert(domainObject, location, type, values) {
                 .ok(() => true));
 
             if (error) throw new BoxError(BoxError.NETWORK_ERROR, error);
-            if (response.statusCode === 403 || response.statusCode === 401) throw new BoxError(BoxError.ACCESS_DENIED, formatError(response));
-            if (response.statusCode === 422) throw new BoxError(BoxError.BAD_FIELD, response.body.message);
-            if (response.statusCode !== 201) throw new BoxError(BoxError.EXTERNAL_ERROR, formatError(response));
+            if (response.status === 403 || response.status === 401) throw new BoxError(BoxError.ACCESS_DENIED, formatError(response));
+            if (response.status === 422) throw new BoxError(BoxError.BAD_FIELD, response.body.message);
+            if (response.status !== 201) throw new BoxError(BoxError.EXTERNAL_ERROR, formatError(response));
 
             recordIds.push(safe.query(records.body, 'domain_record.id'));
         } else {
@@ -130,9 +130,9 @@ async function upsert(domainObject, location, type, values) {
             ++i;
 
             if (error) throw new BoxError(BoxError.NETWORK_ERROR, error);
-            if (response.statusCode === 403 || response.statusCode === 401) throw new BoxError(BoxError.ACCESS_DENIED, formatError(response));
-            if (response.statusCode === 422) throw new BoxError(BoxError.BAD_FIELD, response.body.message);
-            if (response.statusCode !== 200) throw new BoxError(BoxError.EXTERNAL_ERROR, formatError(response));
+            if (response.status === 403 || response.status === 401) throw new BoxError(BoxError.ACCESS_DENIED, formatError(response));
+            if (response.status === 422) throw new BoxError(BoxError.BAD_FIELD, response.body.message);
+            if (response.status !== 200) throw new BoxError(BoxError.EXTERNAL_ERROR, formatError(response));
 
             recordIds.push(safe.query(records.body, 'domain_record.id'));
         }
@@ -190,9 +190,9 @@ async function del(domainObject, location, type, values) {
             .ok(() => true));
 
         if (error) throw new BoxError(BoxError.NETWORK_ERROR, error);
-        if (response.statusCode === 404) return;
-        if (response.statusCode === 403 || response.statusCode === 401) throw new BoxError(BoxError.ACCESS_DENIED, formatError(response));
-        if (response.statusCode !== 204) throw new BoxError(BoxError.EXTERNAL_ERROR, formatError(response));
+        if (response.status === 404) return;
+        if (response.status === 403 || response.status === 401) throw new BoxError(BoxError.ACCESS_DENIED, formatError(response));
+        if (response.status !== 204) throw new BoxError(BoxError.EXTERNAL_ERROR, formatError(response));
     }
 }
 
diff --git a/src/dns/dnsimple.js b/src/dns/dnsimple.js
index a67483a3d..308245c62 100644
--- a/src/dns/dnsimple.js
+++ b/src/dns/dnsimple.js
@@ -17,13 +17,13 @@ const assert = require('assert'),
     dig = require('../dig.js'),
     dns = require('../dns.js'),
     safe = require('safetydance'),
-    superagent = require('superagent'),
+    superagent = require('../superagent.js'),
     waitForDns = require('./waitfordns.js');
 
 const DNSIMPLE_API = 'https://api.dnsimple.com/v2';
 
 function formatError(response) {
-    return `dnsimple DNS error ${response.statusCode} ${JSON.stringify(response.body)}`;
+    return `dnsimple DNS error ${response.status} ${response.text}`;
 }
 
 function removePrivateFields(domainObject) {
@@ -44,8 +44,8 @@ async function getAccountId(domainConfig) {
         .timeout(30 * 1000)
         .ok(() => true));
     if (error) throw new BoxError(BoxError.NETWORK_ERROR, error);
-    if (response.statusCode === 401) throw new BoxError(BoxError.ACCESS_DENIED, formatError(response));
-    if (response.statusCode !== 200) throw new BoxError(BoxError.EXTERNAL_ERROR, formatError(response));
+    if (response.status === 401) throw new BoxError(BoxError.ACCESS_DENIED, formatError(response));
+    if (response.status !== 200) throw new BoxError(BoxError.EXTERNAL_ERROR, formatError(response));
 
     const accountId = safe.query(response.body, 'data[0].id', null);
     if (!accountId || typeof accountId !== 'number') throw new BoxError(BoxError.EXTERNAL_ERROR, `Could not determine account id: ${JSON.stringify(response.body)}`);
@@ -63,8 +63,8 @@ async function getZone(domainConfig, zoneName) {
         .timeout(30 * 1000)
         .ok(() => true));
     if (error) throw new BoxError(BoxError.NETWORK_ERROR, error);
-    if (response.statusCode === 401) throw new BoxError(BoxError.ACCESS_DENIED, formatError(response));
-    if (response.statusCode !== 200) throw new BoxError(BoxError.EXTERNAL_ERROR, formatError(response));
+    if (response.status === 401) throw new BoxError(BoxError.ACCESS_DENIED, formatError(response));
+    if (response.status !== 200) throw new BoxError(BoxError.EXTERNAL_ERROR, formatError(response));
 
     if (!Array.isArray(response.body.data)) throw new BoxError(BoxError.EXTERNAL_ERROR, `Invalid data in response: ${JSON.stringify(response.body)}`);
 
@@ -88,8 +88,8 @@ async function getDnsRecords(domainConfig, zoneName, name, type) {
         .timeout(30 * 1000)
         .ok(() => true));
     if (error) throw new BoxError(BoxError.NETWORK_ERROR, error);
-    if (response.statusCode === 401) throw new BoxError(BoxError.ACCESS_DENIED, formatError(response));
-    if (response.statusCode !== 200) throw new BoxError(BoxError.EXTERNAL_ERROR, formatError(response));
+    if (response.status === 401) throw new BoxError(BoxError.ACCESS_DENIED, formatError(response));
+    if (response.status !== 200) throw new BoxError(BoxError.EXTERNAL_ERROR, formatError(response));
     if (!Array.isArray(response.body.data)) throw new BoxError(BoxError.EXTERNAL_ERROR, `Invalid data in response: ${JSON.stringify(response.body)}`);
 
     return response.body.data;
@@ -111,7 +111,8 @@ async function upsert(domainObject, location, type, values) {
     const records = await getDnsRecords(domainConfig, zoneName, name, type);
 
     // used to track available records to update instead of create
-    let i = 0, recordIds = [];
+    let i = 0;
+    const recordIds = [];
 
     for (let value of values) {
         let priority = 0;
@@ -139,8 +140,8 @@ async function upsert(domainObject, location, type, values) {
                 .timeout(30 * 1000)
                 .ok(() => true));
             if (error) throw new BoxError(BoxError.NETWORK_ERROR, error);
-            if (response.statusCode === 401) throw new BoxError(BoxError.ACCESS_DENIED, formatError(response));
-            if (response.statusCode !== 201) throw new BoxError(BoxError.EXTERNAL_ERROR, formatError(response));
+            if (response.status === 401) throw new BoxError(BoxError.ACCESS_DENIED, formatError(response));
+            if (response.status !== 201) throw new BoxError(BoxError.EXTERNAL_ERROR, formatError(response));
             recordIds.push(safe.query(response.body, 'data.id'));
         } else {
             const [error, response] = await safe(superagent.patch(`${DNSIMPLE_API}/${accountId}/zones/${zoneId}/records/${records[i].id}`)
@@ -152,8 +153,8 @@ async function upsert(domainObject, location, type, values) {
             ++i;
 
             if (error) throw new BoxError(BoxError.NETWORK_ERROR, error);
-            if (response.statusCode === 401) throw new BoxError(BoxError.ACCESS_DENIED, formatError(response));
-            if (response.statusCode !== 200) throw new BoxError(BoxError.EXTERNAL_ERROR, formatError(response));
+            if (response.status === 401) throw new BoxError(BoxError.ACCESS_DENIED, formatError(response));
+            if (response.status !== 200) throw new BoxError(BoxError.EXTERNAL_ERROR, formatError(response));
             recordIds.push(safe.query(response.body, 'data.id'));
         }
     }
@@ -208,9 +209,9 @@ async function del(domainObject, location, type, values) {
             .ok(() => true));
 
         if (error) throw new BoxError(BoxError.NETWORK_ERROR, error);
-        if (response.statusCode === 401) throw new BoxError(BoxError.ACCESS_DENIED, formatError(response));
-        if (response.statusCode === 404) continue;
-        if (response.statusCode !== 204) throw new BoxError(BoxError.EXTERNAL_ERROR, formatError(response));
+        if (response.status === 401) throw new BoxError(BoxError.ACCESS_DENIED, formatError(response));
+        if (response.status === 404) continue;
+        if (response.status !== 204) throw new BoxError(BoxError.EXTERNAL_ERROR, formatError(response));
     }
 }
 
diff --git a/src/dns/gandi.js b/src/dns/gandi.js
index d5feb9672..54072003a 100644
--- a/src/dns/gandi.js
+++ b/src/dns/gandi.js
@@ -17,13 +17,13 @@ const assert = require('assert'),
     dig = require('../dig.js'),
     dns = require('../dns.js'),
     safe = require('safetydance'),
-    superagent = require('superagent'),
+    superagent = require('../superagent.js'),
     waitForDns = require('./waitfordns.js');
 
 const GANDI_API = 'https://dns.api.gandi.net/api/v5';
 
 function formatError(response) {
-    return `Gandi DNS error [${response.statusCode}] ${response.body.message}`;
+    return `Gandi DNS error [${response.status}] ${response.text}`;
 }
 
 function removePrivateFields(domainObject) {
@@ -40,7 +40,7 @@ function createRequest(method, url, domainConfig) {
     assert.strictEqual(typeof url, 'string');
     assert.strictEqual(typeof domainConfig, 'object');
 
-    const request = superagent(method, url).timeout(30 * 1000).ok(() => true);
+    const request = superagent.request(method, url).timeout(30 * 1000).ok(() => true);
 
     // https://api.gandi.net/docs/authentication/
     if (domainConfig.tokenType === 'ApiKey') {
@@ -74,9 +74,9 @@ async function upsert(domainObject, location, type, values) {
         .send(data));
 
     if (error) throw new BoxError(BoxError.NETWORK_ERROR, error);
-    if (response.statusCode === 403 || response.statusCode === 401) throw new BoxError(BoxError.ACCESS_DENIED, formatError(response));
-    if (response.statusCode === 400) throw new BoxError(BoxError.BAD_FIELD, formatError(response));
-    if (response.statusCode !== 201) throw new BoxError(BoxError.EXTERNAL_ERROR, formatError(response));
+    if (response.status === 403 || response.status === 401) throw new BoxError(BoxError.ACCESS_DENIED, formatError(response));
+    if (response.status === 400) throw new BoxError(BoxError.BAD_FIELD, formatError(response));
+    if (response.status !== 201) throw new BoxError(BoxError.EXTERNAL_ERROR, formatError(response));
 }
 
 async function get(domainObject, location, type) {
@@ -93,9 +93,9 @@ async function get(domainObject, location, type) {
     const [error, response] = await safe(createRequest('GET', `${GANDI_API}/domains/${zoneName}/records/${name}/${type}`, domainConfig));
 
     if (error) throw new BoxError(BoxError.NETWORK_ERROR, error);
-    if (response.statusCode === 403 || response.statusCode === 401) throw new BoxError(BoxError.ACCESS_DENIED, formatError(response));
-    if (response.statusCode === 404) return [];
-    if (response.statusCode !== 200) throw new BoxError(BoxError.EXTERNAL_ERROR, formatError(response));
+    if (response.status === 403 || response.status === 401) throw new BoxError(BoxError.ACCESS_DENIED, formatError(response));
+    if (response.status === 404) return [];
+    if (response.status !== 200) throw new BoxError(BoxError.EXTERNAL_ERROR, formatError(response));
 
     return response.body.rrset_values;
 }
@@ -115,9 +115,9 @@ async function del(domainObject, location, type, values) {
     const [error, response] = await safe(createRequest('DELETE', `${GANDI_API}/domains/${zoneName}/records/${name}/${type}`, domainConfig));
 
     if (error) throw new BoxError(BoxError.NETWORK_ERROR, error);
-    if (response.statusCode === 404) return;
-    if (response.statusCode === 403 || response.statusCode === 401) throw new BoxError(BoxError.ACCESS_DENIED, formatError(response));
-    if (response.statusCode !== 204) throw new BoxError(BoxError.EXTERNAL_ERROR, formatError(response));
+    if (response.status === 404) return;
+    if (response.status === 403 || response.status === 401) throw new BoxError(BoxError.ACCESS_DENIED, formatError(response));
+    if (response.status !== 204) throw new BoxError(BoxError.EXTERNAL_ERROR, formatError(response));
 }
 
 async function wait(domainObject, subdomain, type, value, options) {
diff --git a/src/dns/godaddy.js b/src/dns/godaddy.js
index 226c7446b..459b23da0 100644
--- a/src/dns/godaddy.js
+++ b/src/dns/godaddy.js
@@ -17,14 +17,14 @@ const assert = require('assert'),
     dig = require('../dig.js'),
     dns = require('../dns.js'),
     safe = require('safetydance'),
-    superagent = require('superagent'),
+    superagent = require('../superagent.js'),
     waitForDns = require('./waitfordns.js');
 
 // const GODADDY_API_OTE = 'https://api.ote-godaddy.com/v1/domains';
 const GODADDY_API = 'https://api.godaddy.com/v1/domains';
 
 function formatError(response) {
-    return `GoDaddy DNS error [${response.statusCode}] ${response.body.message}`;
+    return `GoDaddy DNS error [${response.status}] ${response.text}`;
 }
 
 function removePrivateFields(domainObject) {
@@ -69,10 +69,10 @@ async function upsert(domainObject, location, type, values) {
         .ok(() => true));
 
     if (error) throw new BoxError(BoxError.NETWORK_ERROR, error);
-    if (response.statusCode === 403 || response.statusCode === 401) throw new BoxError(BoxError.ACCESS_DENIED, formatError(response));
-    if (response.statusCode === 400) throw new BoxError(BoxError.BAD_FIELD, formatError(response)); // no such zone
-    if (response.statusCode === 422) throw new BoxError(BoxError.BAD_FIELD, formatError(response)); // conflict
-    if (response.statusCode !== 200) throw new BoxError(BoxError.EXTERNAL_ERROR, formatError(response));
+    if (response.status === 403 || response.status === 401) throw new BoxError(BoxError.ACCESS_DENIED, formatError(response));
+    if (response.status === 400) throw new BoxError(BoxError.BAD_FIELD, formatError(response)); // no such zone
+    if (response.status === 422) throw new BoxError(BoxError.BAD_FIELD, formatError(response)); // conflict
+    if (response.status !== 200) throw new BoxError(BoxError.EXTERNAL_ERROR, formatError(response));
 }
 
 async function get(domainObject, location, type) {
@@ -92,9 +92,9 @@ async function get(domainObject, location, type) {
         .ok(() => true));
 
     if (error) throw new BoxError(BoxError.NETWORK_ERROR, error);
-    if (response.statusCode === 403 || response.statusCode === 401) throw new BoxError(BoxError.ACCESS_DENIED, formatError(response));
-    if (response.statusCode === 404) return [];
-    if (response.statusCode !== 200) throw new BoxError(BoxError.EXTERNAL_ERROR, formatError(response));
+    if (response.status === 403 || response.status === 401) throw new BoxError(BoxError.ACCESS_DENIED, formatError(response));
+    if (response.status === 404) return [];
+    if (response.status !== 200) throw new BoxError(BoxError.EXTERNAL_ERROR, formatError(response));
 
     const values = response.body.map(function (record) { return record.data; });
 
@@ -138,9 +138,9 @@ async function del(domainObject, location, type, values) {
         .ok(() => true));
 
     if (error) throw new BoxError(BoxError.NETWORK_ERROR, error);
-    if (response.statusCode === 404) return;
-    if (response.statusCode === 403 || response.statusCode === 401) throw new BoxError(BoxError.ACCESS_DENIED, formatError(response));
-    if (response.statusCode !== 204) throw new BoxError(BoxError.EXTERNAL_ERROR, formatError(response));
+    if (response.status === 404) return;
+    if (response.status === 403 || response.status === 401) throw new BoxError(BoxError.ACCESS_DENIED, formatError(response));
+    if (response.status !== 204) throw new BoxError(BoxError.EXTERNAL_ERROR, formatError(response));
 }
 
 async function wait(domainObject, subdomain, type, value, options) {
diff --git a/src/dns/hetzner.js b/src/dns/hetzner.js
index ae86e72e8..850cdfa21 100644
--- a/src/dns/hetzner.js
+++ b/src/dns/hetzner.js
@@ -17,13 +17,13 @@ const assert = require('assert'),
     dig = require('../dig.js'),
     dns = require('../dns.js'),
     safe = require('safetydance'),
-    superagent = require('superagent'),
+    superagent = require('../superagent.js'),
     waitForDns = require('./waitfordns.js');
 
 const ENDPOINT = 'https://dns.hetzner.com/api/v1';
 
 function formatError(response) {
-    return `Hetzner DNS error ${response.statusCode} ${JSON.stringify(response.body)}`;
+    return `Hetzner DNS error ${response.status} ${response.text}`;
 }
 
 function removePrivateFields(domainObject) {
@@ -46,8 +46,8 @@ async function getZone(domainConfig, zoneName) {
         .retry(5)
         .ok(() => true));
     if (error) throw new BoxError(BoxError.NETWORK_ERROR, error);
-    if (response.statusCode === 401 || response.statusCode === 403) throw new BoxError(BoxError.ACCESS_DENIED, formatError(response));
-    if (response.statusCode !== 200) throw new BoxError(BoxError.EXTERNAL_ERROR, formatError(response));
+    if (response.status === 401 || response.status === 403) throw new BoxError(BoxError.ACCESS_DENIED, formatError(response));
+    if (response.status !== 200) throw new BoxError(BoxError.EXTERNAL_ERROR, formatError(response));
 
     if (!Array.isArray(response.body.zones)) throw new BoxError(BoxError.EXTERNAL_ERROR, formatError(response));
 
@@ -77,9 +77,9 @@ async function getZoneRecords(domainConfig, zone, name, type) {
             .ok(() => true));
 
         if (error) throw new BoxError(BoxError.NETWORK_ERROR, error);
-        if (response.statusCode === 404) throw new BoxError(BoxError.NOT_FOUND, formatError(response));
-        if (response.statusCode === 401 || response.statusCode === 403) throw new BoxError(BoxError.ACCESS_DENIED, formatError(response));
-        if (response.statusCode !== 200) throw new BoxError(BoxError.EXTERNAL_ERROR, formatError(response));
+        if (response.status === 404) throw new BoxError(BoxError.NOT_FOUND, formatError(response));
+        if (response.status === 401 || response.status === 403) throw new BoxError(BoxError.ACCESS_DENIED, formatError(response));
+        if (response.status !== 200) throw new BoxError(BoxError.EXTERNAL_ERROR, formatError(response));
 
         matchingRecords = matchingRecords.concat(response.body.records.filter(function (record) {
             return (record.type === type && record.name === name);
@@ -129,9 +129,9 @@ async function upsert(domainObject, location, type, values) {
                 .ok(() => true));
 
             if (error) throw new BoxError(BoxError.NETWORK_ERROR, error);
-            if (response.statusCode === 403 || response.statusCode === 401) throw new BoxError(BoxError.ACCESS_DENIED, formatError(response));
-            if (response.statusCode === 422) throw new BoxError(BoxError.BAD_FIELD, response.body.message);
-            if (response.statusCode !== 200) throw new BoxError(BoxError.EXTERNAL_ERROR, formatError(response));
+            if (response.status === 403 || response.status === 401) throw new BoxError(BoxError.ACCESS_DENIED, formatError(response));
+            if (response.status === 422) throw new BoxError(BoxError.BAD_FIELD, response.body.message);
+            if (response.status !== 200) throw new BoxError(BoxError.EXTERNAL_ERROR, formatError(response));
         } else {
             const [error, response] = await safe(superagent.put(`${ENDPOINT}/records/${records[i].id}`)
                 .set('Auth-API-Token', domainConfig.token)
@@ -143,9 +143,9 @@ async function upsert(domainObject, location, type, values) {
             ++i;
 
             if (error) throw new BoxError(BoxError.NETWORK_ERROR, error);
-            if (response.statusCode === 403 || response.statusCode === 401) throw new BoxError(BoxError.ACCESS_DENIED, formatError(response));
-            if (response.statusCode === 422) throw new BoxError(BoxError.BAD_FIELD, response.body.message);
-            if (response.statusCode !== 200) throw new BoxError(BoxError.EXTERNAL_ERROR, formatError(response));
+            if (response.status === 403 || response.status === 401) throw new BoxError(BoxError.ACCESS_DENIED, formatError(response));
+            if (response.status === 422) throw new BoxError(BoxError.BAD_FIELD, response.body.message);
+            if (response.status !== 200) throw new BoxError(BoxError.EXTERNAL_ERROR, formatError(response));
         }
     }
 
@@ -202,9 +202,9 @@ async function del(domainObject, location, type, values) {
             .ok(() => true));
 
         if (error) throw new BoxError(BoxError.NETWORK_ERROR, error);
-        if (response.statusCode === 404) return;
-        if (response.statusCode === 403 || response.statusCode === 401) throw new BoxError(BoxError.ACCESS_DENIED, formatError(response));
-        if (response.statusCode !== 200) throw new BoxError(BoxError.EXTERNAL_ERROR, formatError(response));
+        if (response.status === 404) return;
+        if (response.status === 403 || response.status === 401) throw new BoxError(BoxError.ACCESS_DENIED, formatError(response));
+        if (response.status !== 200) throw new BoxError(BoxError.EXTERNAL_ERROR, formatError(response));
     }
 }
 
diff --git a/src/dns/linode.js b/src/dns/linode.js
index 259da7685..3ed1d6345 100644
--- a/src/dns/linode.js
+++ b/src/dns/linode.js
@@ -17,13 +17,13 @@ const assert = require('assert'),
     dig = require('../dig.js'),
     dns = require('../dns.js'),
     safe = require('safetydance'),
-    superagent = require('superagent'),
+    superagent = require('../superagent.js'),
     waitForDns = require('./waitfordns.js');
 
 const LINODE_ENDPOINT = 'https://api.linode.com/v4';
 
 function formatError(response) {
-    return `Linode DNS error [${response.statusCode}] ${JSON.stringify(response.body)}`;
+    return `Linode DNS error [${response.status}] ${response.text}`;
 }
 
 function removePrivateFields(domainObject) {
@@ -47,8 +47,8 @@ async function getZoneId(domainConfig, zoneName) {
         .ok(() => true));
 
     if (error) throw new BoxError(BoxError.NETWORK_ERROR, error);
-    if (response.statusCode === 403 || response.statusCode === 401) throw new BoxError(BoxError.ACCESS_DENIED, formatError(response));
-    if (response.statusCode !== 200) throw new BoxError(BoxError.EXTERNAL_ERROR, formatError(response));
+    if (response.status === 403 || response.status === 401) throw new BoxError(BoxError.ACCESS_DENIED, formatError(response));
+    if (response.status !== 200) throw new BoxError(BoxError.EXTERNAL_ERROR, formatError(response));
 
     if (!Array.isArray(response.body.data)) throw new BoxError(BoxError.EXTERNAL_ERROR, 'Invalid response');
 
@@ -84,9 +84,9 @@ async function getZoneRecords(domainConfig, zoneName, name, type) {
             .ok(() => true));
 
         if (error) throw new BoxError(BoxError.NETWORK_ERROR, error);
-        if (response.statusCode === 404) throw new BoxError(BoxError.NOT_FOUND, formatError(response));
-        if (response.statusCode === 403 || response.statusCode === 401) throw new BoxError(BoxError.ACCESS_DENIED, formatError(response));
-        if (response.statusCode !== 200) throw new BoxError(BoxError.EXTERNAL_ERROR, formatError(response));
+        if (response.status === 404) throw new BoxError(BoxError.NOT_FOUND, formatError(response));
+        if (response.status === 403 || response.status === 401) throw new BoxError(BoxError.ACCESS_DENIED, formatError(response));
+        if (response.status !== 200) throw new BoxError(BoxError.EXTERNAL_ERROR, formatError(response));
 
         records = records.concat(response.body.data.filter(function (record) {
             return (record.type === type && record.name === name);
@@ -154,9 +154,9 @@ async function upsert(domainObject, location, type, values) {
                 .ok(() => true));
 
             if (error) throw new BoxError(BoxError.NETWORK_ERROR, error);
-            if (response.statusCode === 400) throw new BoxError(BoxError.BAD_FIELD, formatError(response));
-            if (response.statusCode === 403 || response.statusCode === 401) throw new BoxError(BoxError.ACCESS_DENIED, formatError(response));
-            if (response.statusCode !== 200) throw new BoxError(BoxError.EXTERNAL_ERROR, formatError(response));
+            if (response.status === 400) throw new BoxError(BoxError.BAD_FIELD, formatError(response));
+            if (response.status === 403 || response.status === 401) throw new BoxError(BoxError.ACCESS_DENIED, formatError(response));
+            if (response.status !== 200) throw new BoxError(BoxError.EXTERNAL_ERROR, formatError(response));
 
             recordIds.push(response.body.id);
         } else {
@@ -168,9 +168,9 @@ async function upsert(domainObject, location, type, values) {
                 .ok(() => true));
 
             if (error) throw new BoxError(BoxError.NETWORK_ERROR, error);
-            if (response.statusCode === 400) throw new BoxError(BoxError.BAD_FIELD, formatError(response));
-            if (response.statusCode === 403 || response.statusCode === 401) throw new BoxError(BoxError.ACCESS_DENIED, formatError(response));
-            if (response.statusCode !== 200) throw new BoxError(BoxError.EXTERNAL_ERROR, formatError(response));
+            if (response.status === 400) throw new BoxError(BoxError.BAD_FIELD, formatError(response));
+            if (response.status === 403 || response.status === 401) throw new BoxError(BoxError.ACCESS_DENIED, formatError(response));
+            if (response.status !== 200) throw new BoxError(BoxError.EXTERNAL_ERROR, formatError(response));
 
             ++i;
 
@@ -212,9 +212,9 @@ async function del(domainObject, location, type, values) {
             .retry(5)
             .ok(() => true));
         if (error && !error.response) throw new BoxError(BoxError.NETWORK_ERROR, error);
-        if (response.statusCode === 404) return;
-        if (response.statusCode === 403 || response.statusCode === 401) throw new BoxError(BoxError.ACCESS_DENIED, formatError(response));
-        if (response.statusCode !== 200) throw new BoxError(BoxError.EXTERNAL_ERROR, formatError(response));
+        if (response.status === 404) return;
+        if (response.status === 403 || response.status === 401) throw new BoxError(BoxError.ACCESS_DENIED, formatError(response));
+        if (response.status !== 200) throw new BoxError(BoxError.EXTERNAL_ERROR, formatError(response));
     }
 }
 
diff --git a/src/dns/namecheap.js b/src/dns/namecheap.js
index e2bc2f7a8..e28ffcd64 100644
--- a/src/dns/namecheap.js
+++ b/src/dns/namecheap.js
@@ -18,7 +18,7 @@ const assert = require('assert'),
     dns = require('../dns.js'),
     network = require('../network.js'),
     safe = require('safetydance'),
-    superagent = require('superagent'),
+    superagent = require('../superagent.js'),
     timers = require('timers/promises'),
     util = require('util'),
     waitForDns = require('./waitfordns.js'),
diff --git a/src/dns/namecom.js b/src/dns/namecom.js
index da08b3abe..2733665eb 100644
--- a/src/dns/namecom.js
+++ b/src/dns/namecom.js
@@ -17,13 +17,13 @@ const assert = require('assert'),
     dig = require('../dig.js'),
     dns = require('../dns.js'),
     safe = require('safetydance'),
-    superagent = require('superagent'),
+    superagent = require('../superagent.js'),
     waitForDns = require('./waitfordns.js');
 
 const NAMECOM_API = 'https://api.name.com/v4';
 
 function formatError(response) {
-    return `Name.com DNS error [${response.statusCode}] ${response.text}`;
+    return `name.com DNS error [${response.status}] ${response.text}`;
 }
 
 function removePrivateFields(domainObject) {
@@ -68,8 +68,8 @@ async function addRecord(domainConfig, zoneName, name, type, values) {
         .ok(() => true));
 
     if (error) throw new BoxError(BoxError.NETWORK_ERROR, error);
-    if (response.statusCode === 403) throw new BoxError(BoxError.ACCESS_DENIED, formatError(response));
-    if (response.statusCode !== 200) throw new BoxError(BoxError.EXTERNAL_ERROR, formatError(response));
+    if (response.status === 403) throw new BoxError(BoxError.ACCESS_DENIED, formatError(response));
+    if (response.status !== 200) throw new BoxError(BoxError.EXTERNAL_ERROR, formatError(response));
 }
 
 async function updateRecord(domainConfig, zoneName, recordId, name, type, values) {
@@ -106,8 +106,8 @@ async function updateRecord(domainConfig, zoneName, recordId, name, type, values
         .ok(() => true));
 
     if (error) throw new BoxError(BoxError.NETWORK_ERROR, error);
-    if (response.statusCode === 403) throw new BoxError(BoxError.ACCESS_DENIED, formatError(response));
-    if (response.statusCode !== 200) throw new BoxError(BoxError.EXTERNAL_ERROR, formatError(response));
+    if (response.status === 403) throw new BoxError(BoxError.ACCESS_DENIED, formatError(response));
+    if (response.status !== 200) throw new BoxError(BoxError.EXTERNAL_ERROR, formatError(response));
 }
 
 async function getInternal(domainConfig, zoneName, name, type) {
@@ -124,8 +124,8 @@ async function getInternal(domainConfig, zoneName, name, type) {
         .ok(() => true));
 
     if (error) throw new BoxError(BoxError.NETWORK_ERROR, error);
-    if (response.statusCode === 403) throw new BoxError(BoxError.ACCESS_DENIED, formatError(response));
-    if (response.statusCode !== 200) throw new BoxError(BoxError.EXTERNAL_ERROR, formatError(response));
+    if (response.status === 403) throw new BoxError(BoxError.ACCESS_DENIED, formatError(response));
+    if (response.status !== 200) throw new BoxError(BoxError.EXTERNAL_ERROR, formatError(response));
 
     // name.com does not return the correct content-type
     response.body = safe.JSON.parse(response.text);
@@ -195,8 +195,8 @@ async function del(domainObject, location, type, values) {
         .timeout(30 * 1000)
         .ok(() => true));
     if (error) throw new BoxError(BoxError.NETWORK_ERROR, error);
-    if (response.statusCode === 403) throw new BoxError(BoxError.ACCESS_DENIED, formatError(response));
-    if (response.statusCode !== 200) throw new BoxError(BoxError.EXTERNAL_ERROR, formatError(response));
+    if (response.status === 403) throw new BoxError(BoxError.ACCESS_DENIED, formatError(response));
+    if (response.status !== 200) throw new BoxError(BoxError.EXTERNAL_ERROR, formatError(response));
 }
 
 async function wait(domainObject, subdomain, type, value, options) {
diff --git a/src/dns/netcup.js b/src/dns/netcup.js
index bc04af7bc..897edb8f4 100644
--- a/src/dns/netcup.js
+++ b/src/dns/netcup.js
@@ -17,14 +17,14 @@ const assert = require('assert'),
     dig = require('../dig.js'),
     dns = require('../dns.js'),
     safe = require('safetydance'),
-    superagent = require('superagent'),
+    superagent = require('../superagent.js'),
     waitForDns = require('./waitfordns.js');
 
 const API_ENDPOINT = 'https://ccp.netcup.net/run/webservice/servers/endpoint.php?JSON';
 
 function formatError(response) {
     if (response.body) return `Netcup DNS error [${response.body.statuscode}] ${response.body.longmessage}`;
-    else return `Netcup DNS error [${response.statusCode}] ${response.text}`;
+    else return `Netcup DNS error [${response.status}] ${response.text}`;
 }
 
 function removePrivateFields(domainObject) {
@@ -51,7 +51,7 @@ async function login(domainConfig) {
 
     const [error, response] = await safe(superagent.post(API_ENDPOINT).send(data).ok(() => true));
     if (error) throw new BoxError(BoxError.NETWORK_ERROR, error);
-    if (response.statusCode !== 200) throw new BoxError(BoxError.EXTERNAL_ERROR, formatError(response));
+    if (response.status !== 200) throw new BoxError(BoxError.EXTERNAL_ERROR, formatError(response));
     if (!response.body.responsedata.apisessionid) throw new BoxError(BoxError.ACCESS_DENIED, 'invalid api password');
 
     return response.body.responsedata.apisessionid;
@@ -76,7 +76,7 @@ async function getAllRecords(domainConfig, apiSessionId, zoneName) {
 
     const [error, response] = await safe(superagent.post(API_ENDPOINT).send(data).ok(() => true));
     if (error) throw new BoxError(BoxError.NETWORK_ERROR, error);
-    if (response.statusCode !== 200) throw new BoxError(BoxError.EXTERNAL_ERROR, formatError(response));
+    if (response.status !== 200) throw new BoxError(BoxError.EXTERNAL_ERROR, formatError(response));
 
     return response.body.responsedata.dnsrecords || [];
 }
@@ -134,7 +134,7 @@ async function upsert(domainObject, location, type, values) {
 
     const [error, response] = await safe(superagent.post(API_ENDPOINT).send(data).ok(() => true));
     if (error) throw new BoxError(BoxError.NETWORK_ERROR, error);
-    if (response.statusCode !== 200) throw new BoxError(BoxError.EXTERNAL_ERROR, formatError(response));
+    if (response.status !== 200) throw new BoxError(BoxError.EXTERNAL_ERROR, formatError(response));
     if (response.body.statuscode !== 2000) throw new BoxError(BoxError.EXTERNAL_ERROR, formatError(response));
 }
 
@@ -205,7 +205,7 @@ async function del(domainObject, location, type, values) {
 
     const [error, response] = await safe(superagent.post(API_ENDPOINT).send(data).ok(() => true));
     if (error) throw new BoxError(BoxError.NETWORK_ERROR, error);
-    if (response.statusCode !== 200) throw new BoxError(BoxError.EXTERNAL_ERROR, formatError(response));
+    if (response.status !== 200) throw new BoxError(BoxError.EXTERNAL_ERROR, formatError(response));
     if (response.body.statuscode !== 2000) throw new BoxError(BoxError.EXTERNAL_ERROR, formatError(response));
 }
 
diff --git a/src/dns/ovh.js b/src/dns/ovh.js
index 839fac0ca..de2670797 100644
--- a/src/dns/ovh.js
+++ b/src/dns/ovh.js
@@ -21,7 +21,7 @@ const assert = require('assert'),
     waitForDns = require('./waitfordns.js');
 
 function formatError(error) {
-    return `OVH DNS error ${error.error} ${error.message}`; // error.error is the statusCode
+    return `OVH DNS error ${error.error} ${error.message}`; // error.error is the status
 }
 
 function removePrivateFields(domainObject) {
diff --git a/src/dns/porkbun.js b/src/dns/porkbun.js
index 1ec78bcdd..89e2d3bc0 100644
--- a/src/dns/porkbun.js
+++ b/src/dns/porkbun.js
@@ -17,7 +17,7 @@ const assert = require('assert'),
     dig = require('../dig.js'),
     dns = require('../dns.js'),
     safe = require('safetydance'),
-    superagent = require('superagent'),
+    superagent = require('../superagent.js'),
     timers = require('timers/promises'),
     waitForDns = require('./waitfordns.js');
 
@@ -26,7 +26,7 @@ const assert = require('assert'),
 const PORKBUN_API = 'https://api.porkbun.com/api/json/v3/dns';
 
 function formatError(response) {
-    return `Porkbun DNS error ${response.statusCode} ${JSON.stringify(response.body)}`;
+    return `Porkbun DNS error ${response.status} ${response.text}`;
 }
 
 function removePrivateFields(domainObject) {
@@ -62,7 +62,7 @@ async function getDnsRecords(domainConfig, zoneName, name, type) {
 
     const [error, response] = await safe(createRequest('POST', `${PORKBUN_API}/retrieveByNameType/${zoneName}/${type}/${name}`, data));
     if (error) throw new BoxError(BoxError.NETWORK_ERROR, error);
-    if (response.statusCode !== 200) throw new BoxError(BoxError.EXTERNAL_ERROR, formatError(response));
+    if (response.status !== 200) throw new BoxError(BoxError.EXTERNAL_ERROR, formatError(response));
     if (response.body.status !== 'SUCCESS') throw new BoxError(BoxError.EXTERNAL_ERROR, `Invalid status in response: ${JSON.stringify(response.body)}`);
     if (!Array.isArray(response.body.records)) throw new BoxError(BoxError.EXTERNAL_ERROR, `Invalid records in response: ${JSON.stringify(response.body)}`);
 
@@ -84,8 +84,8 @@ async function delDnsRecords(domainConfig, zoneName, name, type) {
     // deletes all the records matching type+name
     const [error, response] = await safe(createRequest('POST', `${PORKBUN_API}/deleteByNameType/${zoneName}/${type}/${name}`, data));
     if (error) throw new BoxError(BoxError.NETWORK_ERROR, error);
-    if (response.statusCode === 400) return; // not found, "Could not delete record."
-    if (response.statusCode !== 200) throw new BoxError(BoxError.EXTERNAL_ERROR, formatError(response));
+    if (response.status === 400) return; // not found, "Could not delete record."
+    if (response.status !== 200) throw new BoxError(BoxError.EXTERNAL_ERROR, formatError(response));
     if (response.body.status !== 'SUCCESS') throw new BoxError(BoxError.EXTERNAL_ERROR, `Invalid status in response: ${JSON.stringify(response.body)}`);
 }
 
@@ -124,7 +124,7 @@ async function upsert(domainObject, location, type, values) {
         const [error, response] = await safe(createRequest('POST', `${PORKBUN_API}/create/${zoneName}`, data));
 
         if (error) throw new BoxError(BoxError.NETWORK_ERROR, error);
-        if (response.statusCode !== 200) throw new BoxError(BoxError.EXTERNAL_ERROR, formatError(response));
+        if (response.status !== 200) throw new BoxError(BoxError.EXTERNAL_ERROR, formatError(response));
         if (response.body.status !== 'SUCCESS') throw new BoxError(BoxError.EXTERNAL_ERROR, `Invalid status in response: ${JSON.stringify(response.body)}`);
         if (!response.body.id) throw new BoxError(BoxError.EXTERNAL_ERROR, `Invalid id in response: ${JSON.stringify(response.body)}`);
 
@@ -169,8 +169,8 @@ async function del(domainObject, location, type, values) {
     for (const id of ids) {
         const [error, response] = await safe(createRequest('POST', `${PORKBUN_API}/delete/${zoneName}/${id}`, data));
         if (error) throw new BoxError(BoxError.NETWORK_ERROR, error);
-        if (response.statusCode === 400) continue; // not found! "Invalid record id."
-        if (response.statusCode !== 200) throw new BoxError(BoxError.EXTERNAL_ERROR, formatError(response));
+        if (response.status === 400) continue; // not found! "Invalid record id."
+        if (response.status !== 200) throw new BoxError(BoxError.EXTERNAL_ERROR, formatError(response));
         if (response.body.status !== 'SUCCESS') throw new BoxError(BoxError.EXTERNAL_ERROR, `Invalid status in response: ${JSON.stringify(response.body)}`);
     }
 }
diff --git a/src/dns/vultr.js b/src/dns/vultr.js
index ddab97f80..a86f4c24c 100644
--- a/src/dns/vultr.js
+++ b/src/dns/vultr.js
@@ -17,13 +17,13 @@ const assert = require('assert'),
     dig = require('../dig.js'),
     dns = require('../dns.js'),
     safe = require('safetydance'),
-    superagent = require('superagent'),
+    superagent = require('../superagent.js'),
     waitForDns = require('./waitfordns.js');
 
 const VULTR_ENDPOINT = 'https://api.vultr.com/v2';
 
 function formatError(response) {
-    return `Vultr DNS error [${response.statusCode}] ${JSON.stringify(response.body)}`;
+    return `Vultr DNS error [${response.status}] ${response.text}`;
 }
 
 function removePrivateFields(domainObject) {
@@ -51,9 +51,9 @@ async function getZoneRecords(domainConfig, zoneName, name, type) {
 
         const [error, response] = await safe(superagent.get(url).set('Authorization', 'Bearer ' + domainConfig.token).timeout(30 * 1000).retry(5).ok(() => true));
         if (error) throw new BoxError(BoxError.NETWORK_ERROR, error);
-        if (response.statusCode === 404) throw new BoxError(BoxError.NOT_FOUND, formatError(response));
-        if (response.statusCode === 403 || response.statusCode === 401) throw new BoxError(BoxError.ACCESS_DENIED, formatError(response));
-        if (response.statusCode !== 200) throw new BoxError(BoxError.EXTERNAL_ERROR, formatError(response));
+        if (response.status === 404) throw new BoxError(BoxError.NOT_FOUND, formatError(response));
+        if (response.status === 403 || response.status === 401) throw new BoxError(BoxError.ACCESS_DENIED, formatError(response));
+        if (response.status !== 200) throw new BoxError(BoxError.EXTERNAL_ERROR, formatError(response));
 
         records = records.concat(response.body.records.filter(function (record) {
             return (record.type === type && record.name === name);
@@ -122,9 +122,9 @@ async function upsert(domainObject, location, type, values) {
                 .ok(() => true));
 
             if (error) throw new BoxError(BoxError.NETWORK_ERROR, error);
-            if (response.statusCode === 400) throw new BoxError(BoxError.BAD_FIELD, formatError(response));
-            if (response.statusCode === 403 || response.statusCode === 401) throw new BoxError(BoxError.ACCESS_DENIED, formatError(response));
-            if (response.statusCode !== 201) throw new BoxError(BoxError.EXTERNAL_ERROR, formatError(response));
+            if (response.status === 400) throw new BoxError(BoxError.BAD_FIELD, formatError(response));
+            if (response.status === 403 || response.status === 401) throw new BoxError(BoxError.ACCESS_DENIED, formatError(response));
+            if (response.status !== 201) throw new BoxError(BoxError.EXTERNAL_ERROR, formatError(response));
 
             recordIds.push(response.body.record.id);
         } else {
@@ -138,9 +138,9 @@ async function upsert(domainObject, location, type, values) {
             ++i;
 
             if (error) throw new BoxError(BoxError.NETWORK_ERROR, error);
-            if (response.statusCode === 400) throw new BoxError(BoxError.BAD_FIELD, formatError(response));
-            if (response.statusCode === 403 || response.statusCode === 401) throw new BoxError(BoxError.ACCESS_DENIED, formatError(response));
-            if (response.statusCode !== 204) throw new BoxError(BoxError.EXTERNAL_ERROR, formatError(response));
+            if (response.status === 400) throw new BoxError(BoxError.BAD_FIELD, formatError(response));
+            if (response.status === 403 || response.status === 401) throw new BoxError(BoxError.ACCESS_DENIED, formatError(response));
+            if (response.status !== 204) throw new BoxError(BoxError.EXTERNAL_ERROR, formatError(response));
 
             recordIds.push(records[i-1].id);
         }
@@ -182,9 +182,9 @@ async function del(domainObject, location, type, values) {
             .ok(() => true));
 
         if (error) throw new BoxError(BoxError.NETWORK_ERROR, error);
-        if (response.statusCode === 404) continue;
-        if (response.statusCode === 403 || response.statusCode === 401) throw new BoxError(BoxError.ACCESS_DENIED, formatError(response));
-        if (response.statusCode !== 204) throw new BoxError(BoxError.EXTERNAL_ERROR, formatError(response));
+        if (response.status === 404) continue;
+        if (response.status === 403 || response.status === 401) throw new BoxError(BoxError.ACCESS_DENIED, formatError(response));
+        if (response.status !== 204) throw new BoxError(BoxError.EXTERNAL_ERROR, formatError(response));
     }
 }
 
diff --git a/src/graphs.js b/src/graphs.js
index e31c06102..b32d3a2d2 100644
--- a/src/graphs.js
+++ b/src/graphs.js
@@ -12,7 +12,7 @@ const apps = require('./apps.js'),
     os = require('os'),
     safe = require('safetydance'),
     services = require('./services.js'),
-    superagent = require('superagent');
+    superagent = require('./superagent.js');
 
 // for testing locally: curl 'http://${graphite-ip}:8000/graphite-web/render?format=json&from=-1min&target=absolute(collectd.localhost.du-docker.capacity-usage)'
 // the datapoint is (value, timestamp) https://graphite.readthedocs.io/en/latest/
diff --git a/src/mail.js b/src/mail.js
index 7ee31c6fd..ed9333d29 100644
--- a/src/mail.js
+++ b/src/mail.js
@@ -78,7 +78,7 @@ const assert = require('assert'),
     safe = require('safetydance'),
     services = require('./services.js'),
     shell = require('./shell.js')('mail'),
-    superagent = require('superagent'),
+    superagent = require('./superagent.js'),
     validator = require('validator'),
     _ = require('./underscore.js');
 
@@ -1024,7 +1024,7 @@ async function removeSolrIndex(mailbox) {
 
     if (error) throw new BoxError(BoxError.MAIL_ERROR, `Could not remove solr index: ${error.message}`);
 
-    if (response.status !== 200) throw new BoxError(BoxError.MAIL_ERROR, `Error removing solr index - ${response.status} ${JSON.stringify(response.body)}`);
+    if (response.status !== 200) throw new BoxError(BoxError.MAIL_ERROR, `Error removing solr index - ${response.status} ${response.text}`);
 }
 
 async function delMailbox(name, domain, options, auditSource) {
diff --git a/src/network/generic.js b/src/network/generic.js
index c4a6b7d5c..a9ec4397a 100644
--- a/src/network/generic.js
+++ b/src/network/generic.js
@@ -12,10 +12,32 @@ const assert = require('assert'),
     constants = require('../constants.js'),
     debug = require('debug')('box:network/generic'),
     safe = require('safetydance'),
-    superagent = require('superagent');
+    superagent = require('../superagent.js');
 
 const gCache = { ipv4: {}, ipv6: {} }; // each has { timestamp, value, request }
 
+async function getIP(type) {
+    const url = `https://${type}.api.cloudron.io/api/v1/helper/public_ip`;
+
+    gCache[type].value = null; // clear the obsolete value
+
+    debug(`getIP: querying ${url} to get ${type}`);
+    const [networkError, response] = await safe(superagent.get(url).timeout(30 * 1000).retry(2).ok(() => true));
+
+    if (networkError || response.status !== 200) {
+        debug(`getIP: Error getting IP. ${networkError.message}`);
+        throw new BoxError(BoxError.EXTERNAL_ERROR, `Unable to detect ${type}. API server (${type}.api.cloudron.io) unreachable`);
+    }
+
+    if (!response.body && !response.body.ip) {
+        debug('get: Unexpected answer. No "ip" found in response body.', response.body);
+        throw new BoxError(BoxError.EXTERNAL_ERROR, `Unable to detect ${type}. No IP found in response`);
+    }
+
+    gCache[type].value = response.body.ip;
+    gCache[type].timestamp = Date.now();
+}
+
 async function getIPv4(config) {
     assert.strictEqual(typeof config, 'object');
 
@@ -23,31 +45,10 @@ async function getIPv4(config) {
 
     if (gCache.ipv4.value && (Date.now() - gCache.ipv4.timestamp <= 5 * 60 * 1000)) return gCache.ipv4.value;
 
-    let request = gCache.ipv4.request; // allow reuse for parallel requests
-    if (!request) {
-        debug('getIPv4: querying ipv4.api.cloudron.io to get server IPv4');
-        request = superagent.get('https://ipv4.api.cloudron.io/api/v1/helper/public_ip').timeout(30 * 1000).retry(2).ok(() => true);
-        gCache.ipv4.request = request;
-    }
-
-    gCache.ipv4.value = null;
-
-    const [networkError, response] = await safe(request);
-    gCache.ipv4.request = null;
-
-    if (networkError || response.status !== 200) {
-        debug('getIPv4: Error getting IP. %o', networkError);
-        throw new BoxError(BoxError.EXTERNAL_ERROR, 'Unable to detect IPv4. API server (ipv4.api.cloudron.io) unreachable');
-    }
-
-    if (!response.body && !response.body.ip) {
-        debug('getIPv4: Unexpected answer. No "ip" found in response body.', response.body);
-        throw new BoxError(BoxError.EXTERNAL_ERROR, 'Unable to detect IPv4. No IP found in response');
-    }
-
-    gCache.ipv4.value = response.body.ip;
-    gCache.ipv4.timestamp = Date.now();
-    return response.body.ip;
+    if (!gCache.request) gCache.request = getIP('ipv4');
+    await gCache.request;
+    gCache.request = null;
+    return gCache.ipv4.value;
 }
 
 async function getIPv6(config) {
@@ -57,31 +58,10 @@ async function getIPv6(config) {
 
     if (gCache.ipv6.value && (Date.now() - gCache.ipv6.timestamp <= 5 * 60 * 1000)) return gCache.ipv6.value;
 
-    let request = gCache.ipv6.request; // allow reuse for parallel requests
-    if (!request) {
-        debug('getIPv6: querying ipv6.api.cloudron.io to get server IPv6');
-        request = superagent.get('https://ipv6.api.cloudron.io/api/v1/helper/public_ip').timeout(30 * 1000).retry(2).ok(() => true);
-        gCache.ipv6.request = request;
-    }
-
-    gCache.ipv6.value = null;
-
-    const [networkError, response] = await safe(request);
-    gCache.ipv6.request = null;
-
-    if (networkError || response.status !== 200) {
-        debug('getIPv6: Error getting IP. %o', networkError);
-        throw new BoxError(BoxError.EXTERNAL_ERROR, 'Unable to detect IPv6. API server (ipv6.api.cloudron.io) unreachable');
-    }
-
-    if (!response.body && !response.body.ip) {
-        debug('getIPv6: Unexpected answer. No "ip" found in response body.', response.body);
-        throw new BoxError(BoxError.EXTERNAL_ERROR, 'Unable to detect IPv6. No IP found in response');
-    }
-
-    gCache.ipv6.value = response.body.ip;
-    gCache.ipv6.timestamp = Date.now();
-    return response.body.ip;
+    if (!gCache.request) gCache.request = getIP('ipv6');
+    await gCache.request;
+    gCache.request = null;
+    return gCache.ipv6.value;
 }
 
 async function testIPv4Config(config) {
diff --git a/src/routes/filemanager.js b/src/routes/filemanager.js
index 625477b2c..441c64f0c 100644
--- a/src/routes/filemanager.js
+++ b/src/routes/filemanager.js
@@ -40,7 +40,7 @@ function proxy(kind) {
           };
 
           const sftpReq = http.request(opts, function (sftpRes) {
-              res.writeHead(sftpRes.statusCode, sftpRes.headers);
+              res.writeHead(sftpRes.status, sftpRes.headers);
               // note: these are intentionally not handled. response has already been written. do not forward to connect-lastmile
               // sftpRes.on('error', (error) => next(new HttpError(500, `filemanager error: ${error.message} ${error.code}`)));
               // sftpRes.on('end', () => next());
diff --git a/src/routes/mailserver.js b/src/routes/mailserver.js
index 6602067d3..5c5b27998 100644
--- a/src/routes/mailserver.js
+++ b/src/routes/mailserver.js
@@ -39,7 +39,7 @@ async function proxyToMailContainer(port, pathname, req, res, next) {
     };
 
     const sftpReq = http.request(opts, function (sftpRes) {
-        res.writeHead(sftpRes.statusCode, sftpRes.headers);
+        res.writeHead(sftpRes.status, sftpRes.headers);
         sftpRes.on('error', (error) => next(new HttpError(500, `mailserver error: ${error.message} ${error.code}`)));
         sftpRes.on('end', () => next());
         sftpRes.pipe(res);
diff --git a/src/routes/profile.js b/src/routes/profile.js
index eaa95a23a..fac04e612 100644
--- a/src/routes/profile.js
+++ b/src/routes/profile.js
@@ -157,8 +157,8 @@ async function getAvatar(req, res, next) {
     if (avatar.equals(constants.AVATAR_GRAVATAR)) {
         const gravatarHash = crypto.createHash('md5').update(user.email).digest('hex');
         https.get(`https://www.gravatar.com/avatar/${gravatarHash}.jpg`, function (upstreamRes) {
-            if (upstreamRes.statusCode !== 200) {
-                console.error('Gravatar error:', upstreamRes.statusCode);
+            if (upstreamRes.status !== 200) {
+                console.error('Gravatar error:', upstreamRes.status);
                 return res.status(404).end();
             }
 
diff --git a/src/routes/provision.js b/src/routes/provision.js
index 156d0a75d..b2a6137ef 100644
--- a/src/routes/provision.js
+++ b/src/routes/provision.js
@@ -21,7 +21,7 @@ const assert = require('assert'),
     paths = require('../paths.js'),
     provision = require('../provision.js'),
     safe = require('safetydance'),
-    superagent = require('superagent'),
+    superagent = require('../superagent.js'),
     system = require('../system.js'),
     users = require('../users.js');
 
@@ -56,12 +56,12 @@ async function providerTokenAuth(req, res, next) {
         const imdsIp = req.body.ipv4Config?.provider === 'noop' ? '[fd00:ec2::254]' : '169.254.169.254'; // use ipv4config carefully, it's not validated yet at this point
         const [tokenError, tokenResponse] = await safe(superagent.put(`http://${imdsIp}/latest/api/token`).set('x-aws-ec2-metadata-token-ttl-seconds', 600).timeout(30 * 1000).ok(() => true));
         if (tokenError) return next(new HttpError(422, `Network error getting EC2 metadata session token: ${tokenError.message}`));
-        if (tokenResponse.status !== 200) return next(new HttpError(422, `Unable to get EC2 meta data session token. statusCode: ${tokenResponse.status}`));
+        if (tokenResponse.status !== 200) return next(new HttpError(422, `Unable to get EC2 meta data session token. status: ${tokenResponse.status}`));
         const imdsToken = tokenResponse.text;
 
         const [error, response] = await safe(superagent.get(`http://${imdsIp}/latest/meta-data/instance-id`).set('x-aws-ec2-metadata-token', imdsToken).timeout(30 * 1000).ok(() => true));
         if (error) return next(new HttpError(422, `Network error getting EC2 metadata: ${error.message}`));
-        if (response.status !== 200) return next(new HttpError(422, `Unable to get EC2 meta data. statusCode: ${response.status}`));
+        if (response.status !== 200) return next(new HttpError(422, `Unable to get EC2 meta data. status: ${response.status}`));
         if (response.text !== req.body.providerToken) return next(new HttpError(422, 'Instance ID does not match'));
 
         next();
diff --git a/src/routes/test/api-test.js b/src/routes/test/api-test.js
index 0d570f89c..5e3fa1a05 100644
--- a/src/routes/test/api-test.js
+++ b/src/routes/test/api-test.js
@@ -8,7 +8,7 @@
 
 const common = require('./common.js'),
     expect = require('expect.js'),
-    superagent = require('superagent'),
+    superagent = require('../../superagent.js'),
     timers = require('timers/promises'),
     tokens = require('../../tokens.js');
 
@@ -26,7 +26,7 @@ describe('API', function () {
                 .send('some invalid non-strict json')
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(400);
+            expect(response.status).to.equal(400);
             expect(response.body.message).to.be('Failed to parse body');
         });
 
@@ -37,7 +37,7 @@ describe('API', function () {
                 .send('some string')
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(400);
+            expect(response.status).to.equal(400);
         });
     });
 
@@ -47,7 +47,7 @@ describe('API', function () {
                 .auth(owner.username, owner.password)
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(401);
+            expect(response.status).to.equal(401);
         });
 
         it('cannot get userInfo with invalid token (token length)', async function () {
@@ -55,7 +55,7 @@ describe('API', function () {
                 .query({ access_token: 'x' + owner.token })
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(401);
+            expect(response.status).to.equal(401);
         });
 
 
@@ -63,7 +63,7 @@ describe('API', function () {
             const response = await superagent.get(`${serverUrl}/api/v1/users/${user.id}`)
                 .set('Authorization', 'Bearer ' + owner.token);
 
-            expect(response.statusCode).to.equal(200);
+            expect(response.status).to.equal(200);
             expect(response.body.username).to.equal(user.username.toLowerCase());
             expect(response.body.email).to.equal(user.email.toLowerCase());
         });
@@ -73,7 +73,7 @@ describe('API', function () {
                 .set('Authorization', 'Bearer ' + 'x' + owner.token)
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(401);
+            expect(response.status).to.equal(401);
         });
 
         it('cannot get userInfo with expired token', async function () {
@@ -85,20 +85,20 @@ describe('API', function () {
                 lastUsedTime: null
             };
 
-            let result = await tokens.add(token2);
+            const result = await tokens.add(token2);
             token2.id = result.id;
             token2.accessToken = result.accessToken;
 
             const response = await superagent.get(`${serverUrl}/api/v1/users/${user.id}`)
                 .set('Authorization', 'Bearer ' + token2.accessToken);
-            expect(response.statusCode).to.be(200);
+            expect(response.status).to.be(200);
 
             await timers.setTimeout(3000); // wait for token to expire
 
             const response2 = await superagent.get(`${serverUrl}/api/v1/users/${user.id}`)
                 .set('Authorization', 'Bearer ' + token2.accessToken)
                 .ok(() => true);
-            expect(response2.statusCode).to.be(401);
+            expect(response2.status).to.be(401);
 
         });
     });
diff --git a/src/routes/test/applinks-test.js b/src/routes/test/applinks-test.js
index 99f63414a..d144b91e2 100644
--- a/src/routes/test/applinks-test.js
+++ b/src/routes/test/applinks-test.js
@@ -8,7 +8,7 @@
 const applinks = require('../../applinks.js'),
     common = require('./common.js'),
     expect = require('expect.js'),
-    superagent = require('superagent');
+    superagent = require('../../superagent.js');
 
 describe('AppLinks API', function () {
     const { setup, cleanup, serverUrl, owner } = common;
@@ -22,7 +22,7 @@ describe('AppLinks API', function () {
         const response = await superagent.post(`${serverUrl}/api/v1/applinks`)
             .query({ access_token: owner.token })
             .send({ label: 'Berlin', tags: ['city'], upstreamUri: 'https://www.berlin.de', accessRestriction: null });
-        expect(response.statusCode).to.equal(201);
+        expect(response.status).to.equal(201);
         expect(response.body.id).to.be.ok();
 
         applinkId = response.body.id;
@@ -32,14 +32,14 @@ describe('AppLinks API', function () {
         const response = await superagent.get(`${serverUrl}/api/v1/applinks/random`)
             .query({ access_token: owner.token })
             .ok(() => true);
-        expect(response.statusCode).to.equal(404);
+        expect(response.status).to.equal(404);
     });
 
     it('cannot get valid applink', async function () {
         const response = await superagent.get(`${serverUrl}/api/v1/applinks/${applinkId}`)
             .query({ access_token: owner.token })
             .ok(() => true);
-        expect(response.statusCode).to.equal(200);
+        expect(response.status).to.equal(200);
         expect(response.body.upstreamUri).to.be('https://www.berlin.de');
     });
 
@@ -47,7 +47,7 @@ describe('AppLinks API', function () {
         const response = await superagent.get(`${serverUrl}/api/v1/applinks/${applinkId}/icon`)
             .query({ access_token: owner.token })
             .ok(() => true);
-        expect(response.statusCode).to.equal(200);
+        expect(response.status).to.equal(200);
         expect(response.headers['content-type']).to.be('application/octet-stream');
     });
 
@@ -55,7 +55,7 @@ describe('AppLinks API', function () {
         const response = await superagent.post(`${serverUrl}/api/v1/applinks/${applinkId}`)
             .query({ access_token: owner.token })
             .send({ tags: ['city', 'germany'] });
-        expect(response.statusCode).to.equal(200);
+        expect(response.status).to.equal(200);
 
         const result = await applinks.get(applinkId);
         expect(result.tags).to.eql(['city', 'germany']);
@@ -64,7 +64,7 @@ describe('AppLinks API', function () {
     it('can list applinks', async function () {
         const response = await superagent.get(`${serverUrl}/api/v1/applinks`)
             .query({ access_token: owner.token });
-        expect(response.statusCode).to.equal(200);
+        expect(response.status).to.equal(200);
         expect(response.body.applinks.length).to.equal(1);
         expect(response.body.applinks[0].upstreamUri).to.be('https://www.berlin.de');
     });
@@ -73,14 +73,14 @@ describe('AppLinks API', function () {
         const response = await superagent.del(`${serverUrl}/api/v1/applinks/random`)
             .query({ access_token: owner.token })
             .ok(() => true);
-        expect(response.statusCode).to.equal(404);
+        expect(response.status).to.equal(404);
     });
 
     it('can del applink', async function () {
         const response = await superagent.del(`${serverUrl}/api/v1/applinks/${applinkId}`)
             .query({ access_token: owner.token })
             .ok(() => true);
-        expect(response.statusCode).to.equal(204);
+        expect(response.status).to.equal(204);
 
         const result = await applinks.get(applinkId);
         expect(result).to.be(null);
diff --git a/src/routes/test/apppasswords-test.js b/src/routes/test/apppasswords-test.js
index 4b5bfa3a0..d3ea8a1b6 100644
--- a/src/routes/test/apppasswords-test.js
+++ b/src/routes/test/apppasswords-test.js
@@ -8,7 +8,7 @@
 
 const common = require('./common.js'),
     expect = require('expect.js'),
-    superagent = require('superagent');
+    superagent = require('../../superagent.js');
 
 describe('App Passwords', function () {
     const { setup, cleanup, serverUrl, user } = common;
@@ -23,7 +23,7 @@ describe('App Passwords', function () {
                 .send({ name: 'my-device', identifier: 'someapp' })
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(401);
+            expect(response.status).to.equal(401);
         });
 
         it('cannot add app password without name', async function () {
@@ -32,7 +32,7 @@ describe('App Passwords', function () {
                 .send({ identifier: 'someapp' })
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(400);
+            expect(response.status).to.equal(400);
         });
 
         let pwd;
@@ -41,7 +41,7 @@ describe('App Passwords', function () {
                 .query({ access_token: user.token })
                 .send({ name: 'my-device', identifier: 'someapp' });
 
-            expect(response.statusCode).to.equal(201);
+            expect(response.status).to.equal(201);
             expect(response.body.password).to.be.a('string');
             pwd = response.body;
         });
@@ -50,7 +50,7 @@ describe('App Passwords', function () {
             const response = await superagent.get(`${serverUrl}/api/v1/app_passwords`)
                 .query({ access_token: user.token });
 
-            expect(response.statusCode).to.equal(200);
+            expect(response.status).to.equal(200);
             expect(response.body.appPasswords).to.be.an(Array);
             expect(response.body.appPasswords.length).to.be(1);
             expect(response.body.appPasswords[0].name).to.be('my-device');
@@ -63,7 +63,7 @@ describe('App Passwords', function () {
             const response = await superagent.get(`${serverUrl}/api/v1/app_passwords/${pwd.id}`)
                 .query({ access_token: user.token });
 
-            expect(response.statusCode).to.equal(200);
+            expect(response.status).to.equal(200);
             expect(response.body.name).to.be('my-device');
             expect(response.body.identifier).to.be('someapp');
             expect(response.body.hashedPassword).to.be(undefined);
@@ -74,7 +74,7 @@ describe('App Passwords', function () {
             const response = await superagent.del(`${serverUrl}/api/v1/app_passwords/${pwd.id}`)
                 .query({ access_token: user.token });
 
-            expect(response.statusCode).to.equal(204);
+            expect(response.status).to.equal(204);
         });
     });
 });
diff --git a/src/routes/test/apps-test.js b/src/routes/test/apps-test.js
index aff59e4da..a0d473977 100644
--- a/src/routes/test/apps-test.js
+++ b/src/routes/test/apps-test.js
@@ -24,7 +24,7 @@ const apps = require('../../apps.js'),
     safe = require('safetydance'),
     server = require('../../server.js'),
     settings = require('../../settings.js'),
-    superagent = require('superagent'),
+    superagent = require('../../superagent.js'),
     tokens = require('../../tokens.js'),
     url = require('url');
 
@@ -97,7 +97,7 @@ function waitForTask(taskId, callback) {
             .end(function (error, result) {
                 process.stdout.write('.');
 
-                if (!result || result.statusCode !== 200) return retryCallback(null, new Error('Bad result'));
+                if (!result || result.status !== 200) return retryCallback(null, new Error('Bad result'));
 
                 if (result.body.active) return retryCallback(new Error('Still active'));
 
@@ -113,7 +113,7 @@ function waitForSetup(done) {
     async.retry({ times: 5, interval: 4000 }, function (retryCallback) {
         superagent.get(SERVER_URL + '/api/v1/cloudron/status')
             .end(function (error, result) {
-                if (!result || result.statusCode !== 200) return retryCallback(new Error('Bad result'));
+                if (!result || result.status !== 200) return retryCallback(new Error('Bad result'));
 
                 if (!result.body.setup.active && result.body.setup.errorMessage === '' && result.body.adminFqdn) return retryCallback();
 
@@ -146,7 +146,7 @@ function startBox(done) {
                 .send({ domainConfig: DOMAIN_0 })
                 .end(function (error, result) {
                     expect(result).to.be.ok();
-                    expect(result.statusCode).to.eql(200);
+                    expect(result.status).to.eql(200);
 
                     waitForSetup(callback);
                 });
@@ -157,7 +157,7 @@ function startBox(done) {
                 .send({ username: USERNAME, password: PASSWORD, email: EMAIL })
                 .end(function (error, result) {
                     expect(result).to.be.ok();
-                    expect(result.statusCode).to.eql(201);
+                    expect(result.status).to.eql(201);
 
                     // stash for further use
                     token = result.body.token;
@@ -171,7 +171,7 @@ function startBox(done) {
                 .query({ access_token: token })
                 .send({ username: USERNAME_1, email: EMAIL_1, invite: false })
                 .end(async function (err, res) {
-                    expect(res.statusCode).to.equal(201);
+                    expect(res.status).to.equal(201);
 
                     user_1_id = res.body.id;
                     token_1 = hat(8 * 32);
@@ -236,7 +236,7 @@ xdescribe('App API', function () {
             superagent.post(SERVER_URL + '/api/v1/apps')
                 .query({ access_token: token })
                 .end(function (err, res) {
-                    expect(res.statusCode).to.equal(400);
+                    expect(res.status).to.equal(400);
                     expect(res.body.message).to.eql('appStoreId or manifest is required');
                     done();
                 });
@@ -247,7 +247,7 @@ xdescribe('App API', function () {
                 .query({ access_token: token })
                 .send({ manifest: null })
                 .end(function (err, res) {
-                    expect(res.statusCode).to.equal(400);
+                    expect(res.status).to.equal(400);
                     expect(res.body.message).to.eql('appStoreId or manifest is required');
                     done();
                 });
@@ -258,7 +258,7 @@ xdescribe('App API', function () {
                 .query({ access_token: token })
                 .send({ manifest: 'epic' })
                 .end(function (err, res) {
-                    expect(res.statusCode).to.equal(400);
+                    expect(res.status).to.equal(400);
                     expect(res.body.message).to.eql('manifest must be an object');
                     done();
                 });
@@ -269,7 +269,7 @@ xdescribe('App API', function () {
                 .query({ access_token: token })
                 .send({ manifest: null, appStoreId: '' })
                 .end(function (err, res) {
-                    expect(res.statusCode).to.equal(400);
+                    expect(res.status).to.equal(400);
                     expect(res.body.message).to.eql('appStoreId or manifest is required');
                     done();
                 });
@@ -280,7 +280,7 @@ xdescribe('App API', function () {
                 .query({ access_token: token })
                 .send('garbage')
                 .end(function (err, res) {
-                    expect(res.statusCode).to.equal(400);
+                    expect(res.status).to.equal(400);
                     done();
                 });
         });
@@ -290,7 +290,7 @@ xdescribe('App API', function () {
                 .query({ access_token: token })
                 .send({ manifest: APP_MANIFEST, subdomain: 'some', accessRestriction: null })
                 .end(function (err, res) {
-                    expect(res.statusCode).to.equal(400);
+                    expect(res.status).to.equal(400);
                     expect(res.body.message).to.eql('domain is required');
                     done();
                 });
@@ -301,7 +301,7 @@ xdescribe('App API', function () {
                 .query({ access_token: token })
                 .send({ manifest: APP_MANIFEST, subdomain: 'some', accessRestriction: null, domain: 'doesnotexist.com' })
                 .end(function (err, res) {
-                    expect(res.statusCode).to.equal(400);
+                    expect(res.status).to.equal(400);
                     expect(res.body.message).to.eql('No such domain');
                     done();
                 });
@@ -312,7 +312,7 @@ xdescribe('App API', function () {
                 .query({ access_token: token })
                 .send({ manifest: APP_MANIFEST, subdomain: 42, accessRestriction: null, domain: DOMAIN_0.domain })
                 .end(function (err, res) {
-                    expect(res.statusCode).to.equal(400);
+                    expect(res.status).to.equal(400);
                     expect(res.body.message).to.eql('subdomain is required');
                     done();
                 });
@@ -323,7 +323,7 @@ xdescribe('App API', function () {
                 .query({ access_token: token })
                 .send({ manifest: APP_MANIFEST, subdomain: 'my', accessRestriction: null, domain: DOMAIN_0.domain })
                 .end(function (err, res) {
-                    expect(res.statusCode).to.equal(400);
+                    expect(res.status).to.equal(400);
                     expect(res.body.message).to.contain('my is reserved');
                     done();
                 });
@@ -334,7 +334,7 @@ xdescribe('App API', function () {
                 .query({ access_token: token })
                 .send({ manifest: APP_MANIFEST, subdomain: constants.SMTP_SUBDOMAIN, accessRestriction: null, domain: DOMAIN_0.domain })
                 .end(function (err, res) {
-                    expect(res.statusCode).to.equal(400);
+                    expect(res.status).to.equal(400);
                     expect(res.body.message).to.contain(constants.SMTP_SUBDOMAIN + ' is reserved');
                     done();
                 });
@@ -345,7 +345,7 @@ xdescribe('App API', function () {
                 .query({ access_token: token })
                 .send({ manifest: APP_MANIFEST, subdomain: APP_SUBDOMAIN, portBindings: 23, accessRestriction: null, domain: DOMAIN_0.domain })
                 .end(function (err, res) {
-                    expect(res.statusCode).to.equal(400);
+                    expect(res.status).to.equal(400);
                     expect(res.body.message).to.contain('portBindings must be an object');
                     done();
                 });
@@ -356,7 +356,7 @@ xdescribe('App API', function () {
                 .query({ access_token: token })
                 .send({ manifest: APP_MANIFEST, subdomain: APP_SUBDOMAIN, portBindings: {}, domain: DOMAIN_0.domain })
                 .end(function (err, res) {
-                    expect(res.statusCode).to.equal(400);
+                    expect(res.status).to.equal(400);
                     expect(res.body.message).to.contain('accessRestriction is required');
                     done();
                 });
@@ -367,7 +367,7 @@ xdescribe('App API', function () {
                 .query({ access_token: token })
                 .send({ manifest: APP_MANIFEST, subdomain: APP_SUBDOMAIN, portBindings: {}, accessRestriction: '', domain: DOMAIN_0.domain })
                 .end(function (err, res) {
-                    expect(res.statusCode).to.equal(400);
+                    expect(res.status).to.equal(400);
                     expect(res.body.message).to.contain('accessRestriction is required');
                     done();
                 });
@@ -378,7 +378,7 @@ xdescribe('App API', function () {
                 .query({ access_token: token_1 })
                 .send({ manifest: APP_MANIFEST, subdomain: APP_SUBDOMAIN, portBindings: null, accessRestriction: null, domain: DOMAIN_0.domain })
                 .end(function (err, res) {
-                    expect(res.statusCode).to.equal(403);
+                    expect(res.status).to.equal(403);
                     done();
                 });
         });
@@ -390,7 +390,7 @@ xdescribe('App API', function () {
                 .query({ access_token: token })
                 .send({ appStoreId: APP_STORE_ID, subdomain: APP_SUBDOMAIN, portBindings: null, domain: DOMAIN_0.domain, accessRestriction: { users: [ 'someuser' ], groups: [] } })
                 .end(function (err, res) {
-                    expect(res.statusCode).to.equal(404);
+                    expect(res.status).to.equal(404);
                     expect(fake.isDone()).to.be.ok();
                     done();
                 });
@@ -403,7 +403,7 @@ xdescribe('App API', function () {
                 .query({ access_token: token })
                 .send({ appStoreId: APP_STORE_ID, subdomain: APP_SUBDOMAIN, domain: DOMAIN_0.domain, portBindings: null, accessRestriction: null })
                 .end(function (err, res) {
-                    expect(res.statusCode).to.equal(402);
+                    expect(res.status).to.equal(402);
                     expect(fake1.isDone()).to.be.ok();
                     done();
                 });
@@ -419,7 +419,7 @@ xdescribe('App API', function () {
                 .query({ access_token: token })
                 .send({ appStoreId: APP_STORE_ID, subdomain: APP_SUBDOMAIN, domain: DOMAIN_0.domain, portBindings: { ECHO_SERVER_PORT: 7171 }, accessRestriction: { users: [ 'someuser' ], groups: [] } })
 
-            expect(res.statusCode).to.equal(202);
+            expect(res.status).to.equal(202);
             expect(res.body.id).to.be.a('string');
             APP_ID = res.body.id;
             expect(fake1.isDone()).to.be.ok();
@@ -432,7 +432,7 @@ xdescribe('App API', function () {
                 .query({ access_token: token })
                 .send({ manifest: APP_MANIFEST, subdomain: APP_SUBDOMAIN, domain: DOMAIN_0.domain, portBindings: null, accessRestriction: null })
                 .end(function (err, res) {
-                    expect(res.statusCode).to.equal(409);
+                    expect(res.status).to.equal(409);
                     done();
                 });
         });
@@ -443,7 +443,7 @@ xdescribe('App API', function () {
             superagent.get(SERVER_URL + '/api/v1/apps/' + APP_ID)
                 .query({ access_token: token })
                 .end(function (err, res) {
-                    expect(res.statusCode).to.equal(200);
+                    expect(res.status).to.equal(200);
                     expect(res.body.id).to.eql(APP_ID);
                     expect(res.body.installationState).to.be.ok();
                     expect(res.body.mailboxName).to.be(APP_SUBDOMAIN + '.app');
@@ -456,7 +456,7 @@ xdescribe('App API', function () {
             superagent.get(SERVER_URL + '/api/v1/apps/kubachi')
                 .query({ access_token: token })
                 .end(function (err, res) {
-                    expect(res.statusCode).to.equal(404);
+                    expect(res.status).to.equal(404);
                     done();
                 });
         });
@@ -465,7 +465,7 @@ xdescribe('App API', function () {
             superagent.get(SERVER_URL + '/api/v1/apps')
                 .query({ access_token: token })
                 .end(function (err, res) {
-                    expect(res.statusCode).to.equal(200);
+                    expect(res.status).to.equal(200);
                     expect(res.body.apps).to.be.an('array');
                     expect(res.body.apps[0].id).to.eql(APP_ID);
                     expect(res.body.apps[0].installationState).to.be.ok();
@@ -477,7 +477,7 @@ xdescribe('App API', function () {
             superagent.get(SERVER_URL + '/api/v1/apps')
                 .query({ access_token: token_1 })
                 .end(function (err, res) {
-                    expect(res.statusCode).to.equal(200);
+                    expect(res.status).to.equal(200);
                     expect(res.body.apps).to.be.an('array');
                     expect(res.body.apps.length).to.equal(0);
                     done();
@@ -496,7 +496,7 @@ xdescribe('App API', function () {
             superagent.get(SERVER_URL + '/api/v1/apps/' + APP_ID)
                 .query({ access_token: token })
                 .end(function (err, res) {
-                    if (res.statusCode !== 200) return callback(new Error('Response error'));
+                    if (res.status !== 200) return callback(new Error('Response error'));
                     if (res.body.installationState === apps.ISTATE_INSTALLED) { appResult = res.body; return callback(); }
                     if (res.body.installationState === apps.ISTATE_ERROR) return callback(new Error('Install error'));
 
@@ -570,7 +570,7 @@ xdescribe('App API', function () {
             console.log(`talking to http://${appEntry.containerIp}:7777`);
             superagent.get(`http://${appEntry.containerIp}:7777`).end(function (error, result) {
                 console.dir(error);
-                expect(result.statusCode).to.equal(200);
+                expect(result.status).to.equal(200);
                 done();
             });
         });
@@ -600,7 +600,7 @@ xdescribe('App API', function () {
             superagent.get(SERVER_URL + '/api/v1/apps/' + APP_ID + '/logstream')
                 .query({ access_token: token, fromLine: 0 })
                 .end(function (err, res) {
-                    expect(res.statusCode).to.be(400);
+                    expect(res.status).to.be(400);
                     done();
                 });
         });
@@ -637,7 +637,7 @@ xdescribe('App API', function () {
             superagent.post(SERVER_URL + '/api/v1/apps/' + APP_ID + '/configure/label')
                 .query({ access_token: token })
                 .end(function (err, res) {
-                    expect(res.statusCode).to.equal(400);
+                    expect(res.status).to.equal(400);
                     done();
                 });
         });
@@ -647,7 +647,7 @@ xdescribe('App API', function () {
                 .query({ access_token: token })
                 .send({ label: null })
                 .end(function (err, res) {
-                    expect(res.statusCode).to.equal(400);
+                    expect(res.status).to.equal(400);
                     done();
                 });
         });
@@ -657,7 +657,7 @@ xdescribe('App API', function () {
                 .query({ access_token: token })
                 .send({ label: 'LABEL'})
                 .end(function (err, res) {
-                    expect(res.statusCode).to.equal(200);
+                    expect(res.status).to.equal(200);
                     done();
                 });
         });
@@ -666,7 +666,7 @@ xdescribe('App API', function () {
             superagent.get(SERVER_URL + '/api/v1/apps/' + APP_ID)
                 .query({ access_token: token })
                 .end(function (err, res) {
-                    expect(res.statusCode).to.equal(200);
+                    expect(res.status).to.equal(200);
                     expect(res.body.label).to.be('LABEL');
                     done();
                 });
@@ -677,7 +677,7 @@ xdescribe('App API', function () {
             superagent.post(SERVER_URL + '/api/v1/apps/' + APP_ID + '/configure/tags')
                 .query({ access_token: token })
                 .end(function (err, res) {
-                    expect(res.statusCode).to.equal(400);
+                    expect(res.status).to.equal(400);
                     done();
                 });
         });
@@ -687,7 +687,7 @@ xdescribe('App API', function () {
                 .query({ access_token: token })
                 .send({ tags: null })
                 .end(function (err, res) {
-                    expect(res.statusCode).to.equal(400);
+                    expect(res.status).to.equal(400);
                     done();
                 });
         });
@@ -697,7 +697,7 @@ xdescribe('App API', function () {
                 .query({ access_token: token })
                 .send({ tags: ['tag1', '', 'tag2'] })
                 .end(function (err, res) {
-                    expect(res.statusCode).to.equal(400);
+                    expect(res.status).to.equal(400);
                     done();
                 });
         });
@@ -707,7 +707,7 @@ xdescribe('App API', function () {
                 .query({ access_token: token })
                 .send({ tags: ['tag1', 123, 'tag2'] })
                 .end(function (err, res) {
-                    expect(res.statusCode).to.equal(400);
+                    expect(res.status).to.equal(400);
                     done();
                 });
         });
@@ -717,7 +717,7 @@ xdescribe('App API', function () {
                 .query({ access_token: token })
                 .send({ tags: [ 'tag1', 'tag2' ] })
                 .end(function (err, res) {
-                    expect(res.statusCode).to.equal(200);
+                    expect(res.status).to.equal(200);
                     done();
                 });
         });
@@ -726,7 +726,7 @@ xdescribe('App API', function () {
             superagent.get(SERVER_URL + '/api/v1/apps/' + APP_ID)
                 .query({ access_token: token })
                 .end(function (err, res) {
-                    expect(res.statusCode).to.equal(200);
+                    expect(res.status).to.equal(200);
                     expect(res.body.tags).to.eql([ 'tag1', 'tag2' ]);
                     done();
                 });
@@ -736,7 +736,7 @@ xdescribe('App API', function () {
         it('fails for no icon', function (done) {
             superagent.post(SERVER_URL + '/api/v1/apps/' + APP_ID + '/configure/icon')
                 .end(function (err, res) {
-                    expect(res.statusCode).to.equal(400);
+                    expect(res.status).to.equal(400);
                     done();
                 });
         });
@@ -745,7 +745,7 @@ xdescribe('App API', function () {
             superagent.post(SERVER_URL + '/api/v1/apps/' + APP_ID + '/configure/icon')
                 .send({ icon: 'something non base64' })
                 .end(function (err, res) {
-                    expect(res.statusCode).to.equal(400);
+                    expect(res.status).to.equal(400);
                     done();
                 });
         });
@@ -755,7 +755,7 @@ xdescribe('App API', function () {
                 .query({ access_token: token })
                 .send({ icon: 'iVBORw0KGgoAAAANSUhEUgAAAAEAAAABAQMAAAAl21bKAAAAA1BMVEX/TQBcNTh/AAAAAXRSTlPM0jRW/QAAAApJREFUeJxjYgAAAAYAAzY3fKgAAAAASUVORK5CYII=' })
                 .end(function (err, res) {
-                    expect(res.statusCode).to.equal(200);
+                    expect(res.status).to.equal(200);
                     done();
                 });
         });
@@ -763,7 +763,7 @@ xdescribe('App API', function () {
         it('did set the icon', function (done) {
             superagent.get(SERVER_URL + '/api/v1/apps/' + APP_ID + '/icon')
                 .end(function (err, res) {
-                    expect(res.statusCode).to.equal(200); // response is some PNG
+                    expect(res.status).to.equal(200); // response is some PNG
                     done();
                 });
         });
@@ -773,7 +773,7 @@ xdescribe('App API', function () {
                 .query({ access_token: token })
                 .send({ icon: null })
                 .end(function (err, res) {
-                    expect(res.statusCode).to.equal(200);
+                    expect(res.status).to.equal(200);
                     done();
                 });
         });
@@ -784,7 +784,7 @@ xdescribe('App API', function () {
                 .query({ access_token: token })
                 .send({ enable: false })
                 .end(function (err, res) {
-                    expect(res.statusCode).to.equal(200);
+                    expect(res.status).to.equal(200);
                     done();
                 });
         });
@@ -793,7 +793,7 @@ xdescribe('App API', function () {
             superagent.get(SERVER_URL + '/api/v1/apps/' + APP_ID)
                 .query({ access_token: token })
                 .end(function (err, res) {
-                    expect(res.statusCode).to.equal(200);
+                    expect(res.status).to.equal(200);
                     expect(res.body.enableAutomaticUpdate).to.be(false);
                     done();
                 });
@@ -804,7 +804,7 @@ xdescribe('App API', function () {
                 .query({ access_token: token })
                 .send({ enable: false })
                 .end(function (err, res) {
-                    expect(res.statusCode).to.equal(200);
+                    expect(res.status).to.equal(200);
                     done();
                 });
         });
@@ -813,7 +813,7 @@ xdescribe('App API', function () {
             superagent.get(SERVER_URL + '/api/v1/apps/' + APP_ID)
                 .query({ access_token: token })
                 .end(function (err, res) {
-                    expect(res.statusCode).to.equal(200);
+                    expect(res.status).to.equal(200);
                     expect(res.body.enableBackup).to.be(false);
                     done();
                 });
@@ -825,7 +825,7 @@ xdescribe('App API', function () {
                 .query({ access_token: token })
                 .send({ accessRestriction: false })
                 .end(function (err, res) {
-                    expect(res.statusCode).to.equal(400);
+                    expect(res.status).to.equal(400);
                     done();
                 });
         });
@@ -835,7 +835,7 @@ xdescribe('App API', function () {
                 .query({ access_token: token })
                 .send({ accessRestriction: null })
                 .end(function (err, res) {
-                    expect(res.statusCode).to.equal(200);
+                    expect(res.status).to.equal(200);
                     done();
                 });
         });
@@ -845,7 +845,7 @@ xdescribe('App API', function () {
                 .query({ access_token: token })
                 .send({ accessRestriction: { users: [ 'someuserid' ], groups: [ 'somegroupid' ] } })
                 .end(function (err, res) {
-                    expect(res.statusCode).to.equal(200);
+                    expect(res.status).to.equal(200);
                     done();
                 });
         });
@@ -856,7 +856,7 @@ xdescribe('App API', function () {
                 .query({ access_token: token })
                 .send({ upstreamUri: '' })
                 .end(function (err, res) {
-                    expect(res.statusCode).to.equal(400);
+                    expect(res.status).to.equal(400);
                     done();
                 });
         });
@@ -866,7 +866,7 @@ xdescribe('App API', function () {
                 .query({ access_token: token })
                 .send({ upstreamUri: 'foobar:com' })
                 .end(function (err, res) {
-                    expect(res.statusCode).to.equal(400);
+                    expect(res.status).to.equal(400);
                     done();
                 });
         });
@@ -876,7 +876,7 @@ xdescribe('App API', function () {
                 .query({ access_token: token })
                 .send({ upstreamUri: 'https://1.2.3.4:443' })
                 .end(function (err, res) {
-                    expect(res.statusCode).to.equal(200);
+                    expect(res.status).to.equal(200);
                     done();
                 });
         });
@@ -887,7 +887,7 @@ xdescribe('App API', function () {
                 .query({ access_token: token })
                 .send({ subdomain: APP_SUBDOMAIN, domain: DOMAIN_0.domain, cert: CERT })
                 .end(function (err, res) {
-                    expect(res.statusCode).to.equal(400);
+                    expect(res.status).to.equal(400);
                     done();
                 });
         });
@@ -897,7 +897,7 @@ xdescribe('App API', function () {
                 .query({ access_token: token })
                 .send({ subdomain: APP_SUBDOMAIN, domain: DOMAIN_0.domain, key: KEY })
                 .end(function (err, res) {
-                    expect(res.statusCode).to.equal(400);
+                    expect(res.status).to.equal(400);
                     done();
                 });
         });
@@ -907,7 +907,7 @@ xdescribe('App API', function () {
                 .query({ access_token: token })
                 .send({ subdomain: APP_SUBDOMAIN, domain: DOMAIN_0.domain, cert: 'x' + CERT, key: KEY })
                 .end(function (err, res) {
-                    expect(res.statusCode).to.equal(400);
+                    expect(res.status).to.equal(400);
                     done();
                 });
         });
@@ -917,7 +917,7 @@ xdescribe('App API', function () {
                 .query({ access_token: token })
                 .send({ subdomain: APP_SUBDOMAIN, domain: DOMAIN_0.domain, cert: CERT, key: KEY })
                 .end(function (err, res) {
-                    expect(res.statusCode).to.equal(200);
+                    expect(res.status).to.equal(200);
                     done();
                 });
         });
@@ -927,7 +927,7 @@ xdescribe('App API', function () {
                 .query({ access_token: token })
                 .send({ subdomain: APP_SUBDOMAIN, domain: DOMAIN_0.domain, cert: null, key: null })
                 .end(function (err, res) {
-                    expect(res.statusCode).to.equal(200);
+                    expect(res.status).to.equal(200);
                     done();
                 });
         });
@@ -938,7 +938,7 @@ xdescribe('App API', function () {
             superagent.post(SERVER_URL + '/api/v1/apps/' + APP_ID + '/configure/memory_limit')
                 .query({ access_token: token })
                 .end(function (err, res) {
-                    expect(res.statusCode).to.equal(400);
+                    expect(res.status).to.equal(400);
                     done();
                 });
         });
@@ -948,7 +948,7 @@ xdescribe('App API', function () {
                 .query({ access_token: token })
                 .send({ memoryLimit: -34 })
                 .end(function (err, res) {
-                    expect(res.statusCode).to.equal(400);
+                    expect(res.status).to.equal(400);
                     done();
                 });
         });
@@ -958,7 +958,7 @@ xdescribe('App API', function () {
                 .query({ access_token: token })
                 .send({ memoryLimit: 512 * 1024 * 1024 })
                 .end(function (err, res) {
-                    expect(res.statusCode).to.equal(202);
+                    expect(res.status).to.equal(202);
                     taskId = res.body.taskId;
                     done();
                 });
@@ -987,7 +987,7 @@ xdescribe('App API', function () {
                 .query({ access_token: token })
                 .send({ robotsTxt: 34 })
                 .end(function (err, res) {
-                    expect(res.statusCode).to.equal(400);
+                    expect(res.status).to.equal(400);
                     done();
                 });
         });
@@ -997,7 +997,7 @@ xdescribe('App API', function () {
                 .query({ access_token: token })
                 .send({ robotsTxt: 'any string is good', csp: null })
                 .end(function (err, res) {
-                    expect(res.statusCode).to.equal(200);
+                    expect(res.status).to.equal(200);
                     done();
                 });
         });
@@ -1007,7 +1007,7 @@ xdescribe('App API', function () {
                 .query({ access_token: token })
                 .send({ robotsTxt: null, csp: null })
                 .end(function (err, res) {
-                    expect(res.statusCode).to.equal(200);
+                    expect(res.status).to.equal(200);
                     done();
                 });
         });
@@ -1017,7 +1017,7 @@ xdescribe('App API', function () {
                 .query({ access_token: token })
                 .send({ robotsTxt: null, csp: 34 })
                 .end(function (err, res) {
-                    expect(res.statusCode).to.equal(400);
+                    expect(res.status).to.equal(400);
                     done();
                 });
         });
@@ -1027,7 +1027,7 @@ xdescribe('App API', function () {
                 .query({ access_token: token })
                 .send({ robotsTxt: null, csp: 'frame-ancestors \'self\'' })
                 .end(function (err, res) {
-                    expect(res.statusCode).to.equal(200);
+                    expect(res.status).to.equal(200);
                     done();
                 });
         });
@@ -1037,7 +1037,7 @@ xdescribe('App API', function () {
                 .query({ access_token: token })
                 .send({ robotsTxt: null, csp: null })
                 .end(function (err, res) {
-                    expect(res.statusCode).to.equal(200);
+                    expect(res.status).to.equal(200);
                     done();
                 });
         });
@@ -1049,7 +1049,7 @@ xdescribe('App API', function () {
                 .query({ access_token: token })
                 .send({ subdomain: 'hellothre' })
                 .end(function (err, res) {
-                    expect(res.statusCode).to.equal(400);
+                    expect(res.status).to.equal(400);
                     done();
                 });
         });
@@ -1059,7 +1059,7 @@ xdescribe('App API', function () {
                 .query({ access_token: token })
                 .send({ subdomain: 1234, domain: DOMAIN_0.domain })
                 .end(function (err, res) {
-                    expect(res.statusCode).to.equal(400);
+                    expect(res.status).to.equal(400);
                     done();
                 });
         });
@@ -1069,7 +1069,7 @@ xdescribe('App API', function () {
                 .query({ access_token: token_1 })
                 .send({ subdomain: APP_SUBDOMAIN_NEW, domain: DOMAIN_0.domain, portBindings: { ECHO_SERVER_PORT: 7172 }, accessRestriction: null })
                 .end(function (err, res) {
-                    expect(res.statusCode).to.equal(403);
+                    expect(res.status).to.equal(403);
                     done();
                 });
         });
@@ -1079,7 +1079,7 @@ xdescribe('App API', function () {
                 .query({ access_token: token })
                 .send({ subdomain: APP_SUBDOMAIN_NEW, domain: DOMAIN_0.domain, portBindings: { ECHO_SERVER_PORT: 7172 } })
                 .end(function (err, res) {
-                    expect(res.statusCode).to.equal(202);
+                    expect(res.status).to.equal(202);
                     taskId = res.body.taskId;
                     done();
                 });
@@ -1125,7 +1125,7 @@ xdescribe('App API', function () {
             superagent.post(SERVER_URL + '/api/v1/apps/' + APP_ID + '/configure/debug_mode')
                 .query({ access_token: token })
                 .end(function (err, res) {
-                    expect(res.statusCode).to.equal(400);
+                    expect(res.status).to.equal(400);
                     done();
                 });
         });
@@ -1135,7 +1135,7 @@ xdescribe('App API', function () {
                 .query({ access_token: token })
                 .send({ debugMode: 'sleep' })
                 .end(function (err, res) {
-                    expect(res.statusCode).to.equal(400);
+                    expect(res.status).to.equal(400);
                     done();
                 });
         });
@@ -1145,7 +1145,7 @@ xdescribe('App API', function () {
                 .query({ access_token: token })
                 .send({ debugMode: { readonlyRootfs: false } })
                 .end(function (err, res) {
-                    expect(res.statusCode).to.equal(202);
+                    expect(res.status).to.equal(202);
                     taskId = res.body.taskId;
                     done();
                 });
@@ -1173,7 +1173,7 @@ xdescribe('App API', function () {
                 .query({ access_token: token })
                 .send({ debugMode: null })
                 .end(function (err, res) {
-                    expect(res.statusCode).to.equal(202);
+                    expect(res.status).to.equal(202);
                     taskId = res.body.taskId;
                     done();
                 });
@@ -1202,7 +1202,7 @@ xdescribe('App API', function () {
             superagent.post(SERVER_URL + '/api/v1/apps/' + APP_ID + '/configure/env')
                 .query({ access_token: token })
                 .end(function (err, res) {
-                    expect(res.statusCode).to.equal(400);
+                    expect(res.status).to.equal(400);
                     done();
                 });
         });
@@ -1212,7 +1212,7 @@ xdescribe('App API', function () {
                 .query({ access_token: token })
                 .send({ env: 'ok' })
                 .end(function (err, res) {
-                    expect(res.statusCode).to.equal(400);
+                    expect(res.status).to.equal(400);
                     done();
                 });
         });
@@ -1222,7 +1222,7 @@ xdescribe('App API', function () {
                 .query({ access_token: token })
                 .send({ env: { 'OPM': 'SAITAMA' } })
                 .end(function (err, res) {
-                    expect(res.statusCode).to.equal(202);
+                    expect(res.status).to.equal(202);
                     taskId = res.body.taskId;
                     done();
                 });
@@ -1250,7 +1250,7 @@ xdescribe('App API', function () {
                 .query({ access_token: token })
                 .send({ env: {} })
                 .end(function (err, res) {
-                    expect(res.statusCode).to.equal(202);
+                    expect(res.status).to.equal(202);
                     taskId = res.body.taskId;
                     done();
                 });
@@ -1278,7 +1278,7 @@ xdescribe('App API', function () {
             superagent.post(SERVER_URL + '/api/v1/apps/' + APP_ID + '/configure/mailbox')
                 .query({ access_token: token })
                 .end(function (err, res) {
-                    expect(res.statusCode).to.equal(400);
+                    expect(res.status).to.equal(400);
                     done();
                 });
         });
@@ -1288,7 +1288,7 @@ xdescribe('App API', function () {
                 .query({ access_token: token })
                 .send({ mailbox: 'genos@cloudron.io' })
                 .end(function (err, res) {
-                    expect(res.statusCode).to.equal(400);
+                    expect(res.status).to.equal(400);
                     done();
                 });
         });
@@ -1298,7 +1298,7 @@ xdescribe('App API', function () {
                 .query({ access_token: token })
                 .send({ mailboxName: 'genos', mailboxDomain: DOMAIN_0.domain })
                 .end(function (err, res) {
-                    expect(res.statusCode).to.equal(202);
+                    expect(res.status).to.equal(202);
                     taskId = res.body.taskId;
                     done();
                 });
@@ -1326,7 +1326,7 @@ xdescribe('App API', function () {
                 .query({ access_token: token })
                 .send({ mailboxName: null, mailboxDomain: DOMAIN_0.domain })
                 .end(function (err, res) {
-                    expect(res.statusCode).to.equal(202);
+                    expect(res.status).to.equal(202);
                     taskId = res.body.taskId;
                     done();
                 });
@@ -1354,7 +1354,7 @@ xdescribe('App API', function () {
             superagent.post(SERVER_URL + '/api/v1/apps/' + APP_ID + '/configure/data_dir')
                 .query({ access_token: token })
                 .end(function (err, res) {
-                    expect(res.statusCode).to.equal(400);
+                    expect(res.status).to.equal(400);
                     done();
                 });
         });
@@ -1364,7 +1364,7 @@ xdescribe('App API', function () {
                 .query({ access_token: token })
                 .send({ dataDir: 'what' })
                 .end(function (err, res) {
-                    expect(res.statusCode).to.equal(400);
+                    expect(res.status).to.equal(400);
                     done();
                 });
         });
@@ -1377,7 +1377,7 @@ xdescribe('App API', function () {
                 .query({ access_token: token })
                 .send({ dataDir: dataDir })
                 .end(function (err, res) {
-                    expect(res.statusCode).to.equal(202);
+                    expect(res.status).to.equal(202);
                     taskId = res.body.taskId;
                     done();
                 });
@@ -1392,7 +1392,7 @@ xdescribe('App API', function () {
                 .query({ access_token: token })
                 .send({ dataDir: null })
                 .end(function (err, res) {
-                    expect(res.statusCode).to.equal(202);
+                    expect(res.status).to.equal(202);
                     taskId = res.body.taskId;
                     done();
                 });
@@ -1409,7 +1409,7 @@ xdescribe('App API', function () {
             superagent.post(SERVER_URL + '/api/v1/apps/' + APP_ID + '/stop')
                 .query({ access_token: token_1 })
                 .end(function (err, res) {
-                    expect(res.statusCode).to.equal(403);
+                    expect(res.status).to.equal(403);
                     done();
                 });
         });
@@ -1418,7 +1418,7 @@ xdescribe('App API', function () {
             superagent.post(SERVER_URL + '/api/v1/apps/' + APP_ID + '/stop')
                 .query({ access_token: token })
                 .end(function (err, res) {
-                    expect(res.statusCode).to.equal(202);
+                    expect(res.status).to.equal(202);
                     taskId = res.body.taskId;
                     done();
                 });
@@ -1437,7 +1437,7 @@ xdescribe('App API', function () {
 
                     // wait for app status to be updated
                     superagent.get(SERVER_URL + '/api/v1/apps/' + APP_ID).query({ access_token: token }).end(function (error, result) {
-                        if (error || result.statusCode !== 200 || result.body.runState !== 'stopped') return done(new Error('App is not in stopped state'));
+                        if (error || result.status !== 200 || result.body.runState !== 'stopped') return done(new Error('App is not in stopped state'));
 
                         done();
                     });
@@ -1449,7 +1449,7 @@ xdescribe('App API', function () {
             superagent.post(SERVER_URL + '/api/v1/apps/' + APP_ID + '/start')
                 .query({ access_token: token_1 })
                 .end(function (err, res) {
-                    expect(res.statusCode).to.equal(403);
+                    expect(res.status).to.equal(403);
                     done();
                 });
         });
@@ -1458,7 +1458,7 @@ xdescribe('App API', function () {
             superagent.post(SERVER_URL + '/api/v1/apps/' + APP_ID + '/start')
                 .query({ access_token: token })
                 .end(function (err, res) {
-                    expect(res.statusCode).to.equal(202);
+                    expect(res.status).to.equal(202);
                     taskId = res.body.taskId;
                     done();
                 });
@@ -1474,7 +1474,7 @@ xdescribe('App API', function () {
 
                 superagent.get('http://localhost:' + app.httpPort + APP_MANIFEST.healthCheckPath)
                     .end(function (err, res) {
-                        if (res && res.statusCode === 200) return done();
+                        if (res && res.status === 200) return done();
                         done(new Error('app is not running'));
                     });
             });
@@ -1484,7 +1484,7 @@ xdescribe('App API', function () {
             superagent.post(SERVER_URL + '/api/v1/apps/' + APP_ID + '/restart')
                 .query({ access_token: token })
                 .end(function (err, res) {
-                    expect(res.statusCode).to.equal(202);
+                    expect(res.status).to.equal(202);
                     taskId = res.body.taskId;
                     done();
                 });
@@ -1500,7 +1500,7 @@ xdescribe('App API', function () {
 
                 superagent.get('http://localhost:' + app.httpPort + APP_MANIFEST.healthCheckPath)
                     .end(function (err, res) {
-                        if (res && res.statusCode === 200) return done();
+                        if (res && res.status === 200) return done();
                         done(new Error('app is not running'));
                     });
             });
@@ -1512,7 +1512,7 @@ xdescribe('App API', function () {
             superagent.post(SERVER_URL + '/api/v1/apps/whatever/uninstall')
                 .query({ access_token: token })
                 .end(function (err, res) {
-                    expect(res.statusCode).to.equal(404);
+                    expect(res.status).to.equal(404);
                     done();
                 });
         });
@@ -1521,7 +1521,7 @@ xdescribe('App API', function () {
             superagent.post(SERVER_URL + '/api/v1/apps/' + APP_ID + '/uninstall')
                 .query({ access_token: token_1 })
                 .end(function (err, res) {
-                    expect(res.statusCode).to.equal(403);
+                    expect(res.status).to.equal(403);
                     done();
                 });
         });
@@ -1533,7 +1533,7 @@ xdescribe('App API', function () {
             superagent.post(SERVER_URL + '/api/v1/apps/' + APP_ID + '/uninstall')
                 .query({ access_token: token })
                 .end(function (err, res) {
-                    expect(res.statusCode).to.equal(202);
+                    expect(res.status).to.equal(202);
                     taskId = res.body.taskId;
                     expect(fake1.isDone()).to.be.ok();
                     expect(fake2.isDone()).to.be.ok();
@@ -1562,7 +1562,7 @@ xdescribe('App API', function () {
             superagent.get(SERVER_URL + '/api/v1/apps/' + APP_ID)
                 .query({ access_token: token })
                 .end(function (err, res) {
-                    if (res.statusCode === 404) return done(null);
+                    if (res.status === 404) return done(null);
                     done(new Error('App is still there'));
                 });
         });
diff --git a/src/routes/test/appstore-test.js b/src/routes/test/appstore-test.js
index 8804a1ac2..8cc5efb1a 100644
--- a/src/routes/test/appstore-test.js
+++ b/src/routes/test/appstore-test.js
@@ -11,7 +11,7 @@ const appstore = require('../../appstore.js'),
     expect = require('expect.js'),
     nock = require('nock'),
     settings = require('../../settings.js'),
-    superagent = require('superagent');
+    superagent = require('../../superagent.js');
 
 const { setup, cleanup, serverUrl, owner, appstoreToken } = common;
 
@@ -24,7 +24,7 @@ describe('Appstore Apps API', function () {
         const response = await superagent.get(`${serverUrl}/api/v1/appstore/apps`)
             .query({ access_token: owner.token })
             .ok(() => true);
-        expect(response.statusCode).to.be(424);
+        expect(response.status).to.be(424);
     });
 
     it('cannot get app with bad token', async function () {
@@ -36,7 +36,7 @@ describe('Appstore Apps API', function () {
             .query({ access_token: owner.token })
             .ok(() => true);
 
-        expect(response.statusCode).to.be(412);
+        expect(response.status).to.be(412);
         expect(scope1.isDone()).to.be.ok();
     });
 
@@ -48,7 +48,7 @@ describe('Appstore Apps API', function () {
         const response = await superagent.get(`${serverUrl}/api/v1/appstore/apps`)
             .query({ access_token: owner.token });
 
-        expect(response.statusCode).to.equal(200);
+        expect(response.status).to.equal(200);
         expect(scope1.isDone()).to.be.ok();
     });
 
@@ -60,7 +60,7 @@ describe('Appstore Apps API', function () {
         const response = await superagent.get(`${serverUrl}/api/v1/appstore/apps/org.wordpress.cloudronapp`)
             .query({ access_token: owner.token });
 
-        expect(response.statusCode).to.equal(200);
+        expect(response.status).to.equal(200);
         expect(scope1.isDone()).to.be.ok();
     });
 
@@ -72,7 +72,7 @@ describe('Appstore Apps API', function () {
         const response = await superagent.get(`${serverUrl}/api/v1/appstore/apps/org.wordpress.cloudronapp/versions/3.4.2`)
             .query({ access_token: owner.token });
 
-        expect(response.statusCode).to.equal(200);
+        expect(response.status).to.equal(200);
         expect(scope1.isDone()).to.be.ok();
     });
 });
@@ -102,7 +102,7 @@ describe('Appstore Cloudron Registration API - existing user', function () {
             .query({ access_token: owner.token })
             .ok(() => true);
 
-        expect(response.statusCode).to.equal(201);
+        expect(response.status).to.equal(201);
         expect(scope1.isDone()).to.not.be.ok(); // should not have called register_user since signup is false
         expect(scope2.isDone()).to.be.ok();
         expect(scope3.isDone()).to.be.ok();
@@ -118,7 +118,7 @@ describe('Appstore Cloudron Registration API - existing user', function () {
         const response = await superagent.get(`${serverUrl}/api/v1/appstore/subscription`)
             .query({ access_token: owner.token });
 
-        expect(response.statusCode).to.equal(200);
+        expect(response.status).to.equal(200);
         expect(response.body.email).to.be('test@cloudron.io');
         expect(response.body.subscription).to.be.an('object');
         expect(scope1.isDone()).to.be.ok();
@@ -149,7 +149,7 @@ describe('Appstore Cloudron Registration API - new user signup', function () {
             .send({ email: 'test@cloudron.io', password: 'secret', signup: true })
             .query({ access_token: owner.token });
 
-        expect(response.statusCode).to.equal(201);
+        expect(response.status).to.equal(201);
         expect(scope1.isDone()).to.be.ok();
         expect(scope2.isDone()).to.be.ok();
         expect(scope3.isDone()).to.be.ok();
@@ -164,7 +164,7 @@ describe('Appstore Cloudron Registration API - new user signup', function () {
         const response = await superagent.get(`${serverUrl}/api/v1/appstore/subscription`)
             .query({ access_token: owner.token });
 
-        expect(response.statusCode).to.equal(200);
+        expect(response.status).to.equal(200);
         expect(response.body.email).to.be('test@cloudron.io');
         expect(response.body.subscription).to.be.an('object');
         expect(scope1.isDone()).to.be.ok();
diff --git a/src/routes/test/archives-test.js b/src/routes/test/archives-test.js
index 54eea86ed..7f5b7a709 100644
--- a/src/routes/test/archives-test.js
+++ b/src/routes/test/archives-test.js
@@ -9,7 +9,7 @@ const archives = require('../../archives.js'),
     backups = require('../../backups.js'),
     common = require('./common.js'),
     expect = require('expect.js'),
-    superagent = require('superagent');
+    superagent = require('../../superagent.js');
 
 describe('Archives API', function () {
     const { setup, cleanup, serverUrl, owner, auditSource } = common;
@@ -42,7 +42,7 @@ describe('Archives API', function () {
     it('list succeeds', async function () {
         const response = await superagent.get(`${serverUrl}/api/v1/archives`)
             .query({ access_token: owner.token });
-        expect(response.statusCode).to.equal(200);
+        expect(response.status).to.equal(200);
         expect(response.body.archives.length).to.be(1);
         expect(response.body.archives[0].id).to.be(archiveId);
         expect(response.body.archives[0].appConfig).to.eql(appBackup.appConfig);
@@ -52,7 +52,7 @@ describe('Archives API', function () {
     it('get valid archive', async function () {
         const response = await superagent.get(`${serverUrl}/api/v1/archives/${archiveId}`)
             .query({ access_token: owner.token });
-        expect(response.statusCode).to.equal(200);
+        expect(response.status).to.equal(200);
         expect(response.body.appConfig).to.eql(appBackup.appConfig);
         expect(response.body.manifest).to.eql(appBackup.manifest);
     });
@@ -61,24 +61,24 @@ describe('Archives API', function () {
         const response = await superagent.get(`${serverUrl}/api/v1/archives/random`)
             .query({ access_token: owner.token })
             .ok(() => true);
-        expect(response.statusCode).to.equal(404);
+        expect(response.status).to.equal(404);
     });
 
     it('cannot del invalid archive', async function () {
         const response = await superagent.del(`${serverUrl}/api/v1/archives/random`)
             .query({ access_token: owner.token })
             .ok(() => true);
-        expect(response.statusCode).to.equal(404);
+        expect(response.status).to.equal(404);
     });
 
     it('del valid archive', async function () {
         const response = await superagent.del(`${serverUrl}/api/v1/archives/${archiveId}`)
             .query({ access_token: owner.token });
-        expect(response.statusCode).to.equal(204);
+        expect(response.status).to.equal(204);
 
         const response2 = await superagent.get(`${serverUrl}/api/v1/archives`)
             .query({ access_token: owner.token });
-        expect(response2.statusCode).to.equal(200);
+        expect(response2.status).to.equal(200);
         expect(response2.body.archives.length).to.be(0);
     });
 });
diff --git a/src/routes/test/backups-test.js b/src/routes/test/backups-test.js
index 6d01ff8d4..6cf9a9445 100644
--- a/src/routes/test/backups-test.js
+++ b/src/routes/test/backups-test.js
@@ -8,7 +8,7 @@
 const backups = require('../../backups.js'),
     common = require('./common.js'),
     expect = require('expect.js'),
-    superagent = require('superagent');
+    superagent = require('../../superagent.js');
 
 const BACKUP_FOLDER = '/tmp/backup_test';
 
@@ -33,7 +33,7 @@ describe('Backups API', function () {
                 .send(tmp)
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(400);
+            expect(response.status).to.equal(400);
         });
 
         it('cannot set backup_policy with invalid schedule', async function () {
@@ -45,7 +45,7 @@ describe('Backups API', function () {
                 .send(tmp)
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(400);
+            expect(response.status).to.equal(400);
         });
 
         it('cannot set backup_policy without retention', async function () {
@@ -57,7 +57,7 @@ describe('Backups API', function () {
                 .send(tmp)
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(400);
+            expect(response.status).to.equal(400);
         });
 
         it('cannot set backup_policy with invalid retention', async function () {
@@ -69,7 +69,7 @@ describe('Backups API', function () {
                 .send(tmp)
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(400);
+            expect(response.status).to.equal(400);
         });
 
         it('cannot set backup_policy with empty retention', async function () {
@@ -81,7 +81,7 @@ describe('Backups API', function () {
                 .send(tmp)
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(400);
+            expect(response.status).to.equal(400);
         });
 
         it('cannot set backup_policy with retention missing properties', async function () {
@@ -93,7 +93,7 @@ describe('Backups API', function () {
                 .send(tmp)
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(400);
+            expect(response.status).to.equal(400);
         });
 
         it('cannot set backup_policy with retention with invalid keepWithinSecs', async function () {
@@ -105,7 +105,7 @@ describe('Backups API', function () {
                 .send(tmp)
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(400);
+            expect(response.status).to.equal(400);
         });
     });
 
@@ -122,7 +122,7 @@ describe('Backups API', function () {
             const response = await superagent.get(`${serverUrl}/api/v1/backups/config`)
                 .query({ access_token: owner.token });
 
-            expect(response.statusCode).to.equal(200);
+            expect(response.status).to.equal(200);
             expect(response.body).to.eql(defaultConfig);
         });
 
@@ -135,7 +135,7 @@ describe('Backups API', function () {
                 .send(tmp)
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(400);
+            expect(response.status).to.equal(400);
         });
 
         it('cannot set backup_config with invalid provider', async function () {
@@ -147,7 +147,7 @@ describe('Backups API', function () {
                 .send(tmp)
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(400);
+            expect(response.status).to.equal(400);
         });
 
         it('cannot set backup_config without format', async function () {
@@ -159,7 +159,7 @@ describe('Backups API', function () {
                 .send(tmp)
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(400);
+            expect(response.status).to.equal(400);
         });
 
         it('cannot set backup_config with invalid format', async function () {
@@ -171,7 +171,7 @@ describe('Backups API', function () {
                 .send(tmp)
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(400);
+            expect(response.status).to.equal(400);
         });
 
         it('cannot set backup_config with invalid password', async function () {
@@ -183,7 +183,7 @@ describe('Backups API', function () {
                 .send(tmp)
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(400);
+            expect(response.status).to.equal(400);
         });
 
         it('cannot set backup_config with invalid syncConcurrency', async function () {
@@ -195,7 +195,7 @@ describe('Backups API', function () {
                 .send(tmp)
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(400);
+            expect(response.status).to.equal(400);
         });
 
         it('cannot set backup_config with invalid syncConcurrency', async function () {
@@ -207,7 +207,7 @@ describe('Backups API', function () {
                 .send(tmp)
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(400);
+            expect(response.status).to.equal(400);
         });
 
         it('cannot set backup_config with invalid acceptSelfSignedCerts', async function () {
@@ -219,7 +219,7 @@ describe('Backups API', function () {
                 .send(tmp)
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(400);
+            expect(response.status).to.equal(400);
         });
 
         it('can set backup_config', async function () {
@@ -232,14 +232,14 @@ describe('Backups API', function () {
                 .query({ access_token: owner.token })
                 .send(tmp);
 
-            expect(response.statusCode).to.equal(200);
+            expect(response.status).to.equal(200);
         });
 
         it('can get backup_config', async function () {
             const response = await superagent.get(`${serverUrl}/api/v1/backups/config`)
                 .query({ access_token: owner.token });
 
-            expect(response.statusCode).to.equal(200);
+            expect(response.status).to.equal(200);
             expect(response.body.format).to.equal('rsync');
             expect(response.body.backupFolder).to.equal(BACKUP_FOLDER);
         });
@@ -258,20 +258,20 @@ describe('Backups API', function () {
         it('fails due to mising token', async function () {
             const response = await superagent.post(`${serverUrl}/api/v1/backups/create`)
                 .ok(() => true);
-            expect(response.statusCode).to.equal(401);
+            expect(response.status).to.equal(401);
         });
 
         it('fails due to wrong token', async function () {
             const response = await superagent.post(`${serverUrl}/api/v1/backups/create`)
                 .query({ access_token: 'randomtoken' })
                 .ok(() => true);
-            expect(response.statusCode).to.equal(401);
+            expect(response.status).to.equal(401);
         });
 
         it('succeeds', async function () {
             const response = await superagent.post(`${serverUrl}/api/v1/backups/create`)
                 .query({ access_token: owner.token });
-            expect(response.statusCode).to.equal(202);
+            expect(response.status).to.equal(202);
             expect(response.body.taskId).to.be.a('string');
             await waitForTask(response.body.taskId);
         });
@@ -281,7 +281,7 @@ describe('Backups API', function () {
         it('succeeds', async function () {
             const response = await superagent.get(`${serverUrl}/api/v1/backups`)
                 .query({ access_token: owner.token });
-            expect(response.statusCode).to.equal(200);
+            expect(response.status).to.equal(200);
             expect(response.body.backups.length).to.be(1);
         });
     });
@@ -292,7 +292,7 @@ describe('Backups API', function () {
         before(async function () {
             const response = await superagent.get(`${serverUrl}/api/v1/backups`)
                 .query({ access_token: owner.token });
-            expect(response.statusCode).to.equal(200);
+            expect(response.status).to.equal(200);
             expect(response.body.backups.length).to.be(1);
             someBackup = response.body.backups[0];
         });
@@ -302,7 +302,7 @@ describe('Backups API', function () {
                 .query({ access_token: owner.token })
                 .send({ preserveSecs: 'not-a-number', label: 'some string' })
                 .ok(() => true);
-            expect(response.statusCode).to.equal(400);
+            expect(response.status).to.equal(400);
         });
 
         it('fails for unknown backup', async function () {
@@ -311,14 +311,14 @@ describe('Backups API', function () {
                 .send({ preserveSecs: 30, label: 'NewOrleans' })
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(404);
+            expect(response.status).to.equal(404);
         });
 
         it('succeeds', async function () {
             const response = await superagent.post(`${serverUrl}/api/v1/backups/${someBackup.id}`)
                 .query({ access_token: owner.token })
                 .send({ preserveSecs: 30, label: 'NewOrleans' });
-            expect(response.statusCode).to.equal(200);
+            expect(response.status).to.equal(200);
         });
     });
 });
diff --git a/src/routes/test/branding-test.js b/src/routes/test/branding-test.js
index 31d53c16c..63bd2249e 100644
--- a/src/routes/test/branding-test.js
+++ b/src/routes/test/branding-test.js
@@ -10,7 +10,7 @@ const common = require('./common.js'),
     expect = require('expect.js'),
     fs = require('fs'),
     paths = require('../../paths.js'),
-    superagent = require('superagent');
+    superagent = require('../../superagent.js');
 
 describe('Branding API', function () {
     const { setup, cleanup, serverUrl, owner } = common;
@@ -25,7 +25,7 @@ describe('Branding API', function () {
             const response = await superagent.get(`${serverUrl}/api/v1/branding/cloudron_name`)
                 .query({ access_token: owner.token });
 
-            expect(response.statusCode).to.equal(200);
+            expect(response.status).to.equal(200);
             expect(response.body.name).to.be('Cloudron');
         });
 
@@ -34,7 +34,7 @@ describe('Branding API', function () {
                 .query({ access_token: owner.token })
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(400);
+            expect(response.status).to.equal(400);
         });
 
         it('cannot set empty name', async function () {
@@ -43,7 +43,7 @@ describe('Branding API', function () {
                 .send({ name: '' })
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(400);
+            expect(response.status).to.equal(400);
         });
 
         it('set succeeds', async function () {
@@ -51,14 +51,14 @@ describe('Branding API', function () {
                 .query({ access_token: owner.token })
                 .send({ name });
 
-            expect(response.statusCode).to.equal(200);
+            expect(response.status).to.equal(200);
         });
 
         it('get succeeds', async function () {
             const response = await superagent.get(`${serverUrl}/api/v1/branding/cloudron_name`)
                 .query({ access_token: owner.token });
 
-            expect(response.statusCode).to.equal(200);
+            expect(response.status).to.equal(200);
             expect(response.body.name).to.eql(name);
         });
     });
@@ -68,7 +68,7 @@ describe('Branding API', function () {
             const response = await superagent.get(`${serverUrl}/api/v1/branding/cloudron_avatar`)
                 .query({ access_token: owner.token });
 
-            expect(response.statusCode).to.equal(200);
+            expect(response.status).to.equal(200);
             expect(response.body).to.be.a(Buffer);
         });
 
@@ -77,7 +77,7 @@ describe('Branding API', function () {
                 .query({ access_token: owner.token })
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(400);
+            expect(response.status).to.equal(400);
         });
 
         it('set succeeds', async function () {
@@ -85,14 +85,14 @@ describe('Branding API', function () {
                 .query({ access_token: owner.token })
                 .attach('avatar', paths.CLOUDRON_DEFAULT_AVATAR_FILE);
 
-            expect(response.statusCode).to.equal(200);
+            expect(response.status).to.equal(200);
         });
 
         it('get succeeds', async function () {
             const response = await superagent.get(`${serverUrl}/api/v1/branding/cloudron_avatar`)
                 .query({ access_token: owner.token });
 
-            expect(response.statusCode).to.equal(200);
+            expect(response.status).to.equal(200);
             expect(response.body.toString()).to.eql(fs.readFileSync(paths.CLOUDRON_DEFAULT_AVATAR_FILE, 'utf-8'));
         });
     });
@@ -102,7 +102,7 @@ describe('Branding API', function () {
             const response = await superagent.get(`${serverUrl}/api/v1/branding/footer`)
                 .query({ access_token: owner.token });
 
-            expect(response.statusCode).to.equal(200);
+            expect(response.status).to.equal(200);
             expect(response.body.footer).to.eql(constants.FOOTER);
         });
 
@@ -111,7 +111,7 @@ describe('Branding API', function () {
                 .query({ access_token: owner.token })
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(400);
+            expect(response.status).to.equal(400);
         });
 
         it('set succeeds', async function () {
@@ -119,14 +119,14 @@ describe('Branding API', function () {
                 .query({ access_token: owner.token })
                 .send({ footer: 'BigFoot Inc' });
 
-            expect(response.statusCode).to.equal(200);
+            expect(response.status).to.equal(200);
         });
 
         it('get succeeds', async function () {
             const response = await superagent.get(`${serverUrl}/api/v1/branding/footer`)
                 .query({ access_token: owner.token });
 
-            expect(response.statusCode).to.equal(200);
+            expect(response.status).to.equal(200);
             expect(response.body.footer).to.eql('BigFoot Inc');
         });
     });
diff --git a/src/routes/test/cloudron-test.js b/src/routes/test/cloudron-test.js
index d3ce3bd7d..7d40578e1 100644
--- a/src/routes/test/cloudron-test.js
+++ b/src/routes/test/cloudron-test.js
@@ -8,7 +8,7 @@
 const constants = require('../../constants.js'),
     common = require('./common.js'),
     expect = require('expect.js'),
-    superagent = require('superagent');
+    superagent = require('../../superagent.js');
 
 describe('Cloudron', function () {
     const { setup, cleanup, serverUrl, owner, user, dashboardFqdn } = common;
@@ -21,14 +21,14 @@ describe('Cloudron', function () {
             const response = await superagent.get(`${serverUrl}/api/v1/dashboard/config`)
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(401);
+            expect(response.status).to.equal(401);
         });
 
         it('can get config (admin)', async function () {
             const response = await superagent.get(`${serverUrl}/api/v1/dashboard/config`)
                 .query({ access_token: owner.token });
 
-            expect(response.statusCode).to.equal(200);
+            expect(response.status).to.equal(200);
             expect(response.body.apiServerOrigin).to.eql('http://localhost:6060');
             expect(response.body.webServerOrigin).to.eql('https://cloudron.io');
             expect(response.body.adminFqdn).to.eql(dashboardFqdn);
@@ -40,7 +40,7 @@ describe('Cloudron', function () {
             const response = await superagent.get(`${serverUrl}/api/v1/dashboard/config`)
                 .query({ access_token: user.token });
 
-            expect(response.statusCode).to.equal(200);
+            expect(response.status).to.equal(200);
             expect(response.body.apiServerOrigin).to.eql('http://localhost:6060');
             expect(response.body.webServerOrigin).to.eql('https://cloudron.io');
             expect(response.body.adminFqdn).to.eql(dashboardFqdn);
@@ -61,13 +61,13 @@ describe('Cloudron', function () {
             const response = await superagent.post(`${serverUrl}/api/v1/users`)
                 .query({ access_token: owner.token })
                 .send({ email: USER.email });
-            expect(response.statusCode).to.equal(201);
+            expect(response.status).to.equal(201);
             USER.id = response.body.id;
 
             const response2 = await superagent.get(`${serverUrl}/api/v1/users/${USER.id}/invite_link`)
                 .query({ access_token: owner.token })
                 .ok(() => true);
-            expect(response2.statusCode).to.equal(200);
+            expect(response2.status).to.equal(200);
 
             const response3 = await superagent.post(`${serverUrl}/api/v1/auth/setup_account`)
                 .send({
@@ -77,20 +77,20 @@ describe('Cloudron', function () {
                     displayName: USER.displayName
                 })
                 .ok(() => true);
-            expect(response3.statusCode).to.equal(201);
+            expect(response3.status).to.equal(201);
             expect(response3.body.accessToken).to.be.a('string');
 
             const response4 = await superagent.get(`${serverUrl}/api/v1/users/${USER.id}`)
                 .query({ access_token: owner.token })
                 .ok(() => true);
 
-            expect(response4.statusCode).to.equal(200);
+            expect(response4.status).to.equal(200);
             expect(response4.body.username).to.equal(USER.username);
             expect(response4.body.displayName).to.equal(USER.displayName);
 
             const response5 = await superagent.post(`${serverUrl}/api/v1/auth/login`)
                 .send({ username: USER.username, password: USER.password });
-            expect(response5.statusCode).to.equal(200);
+            expect(response5.status).to.equal(200);
         });
 
         it('succeeds and overwrites with pre-set username and display name', async function () {
@@ -104,13 +104,13 @@ describe('Cloudron', function () {
             const response = await superagent.post(`${serverUrl}/api/v1/users`)
                 .query({ access_token: owner.token })
                 .send({ email: USER.email, username: 'presetup2', displayName: 'pre setup' });
-            expect(response.statusCode).to.equal(201);
+            expect(response.status).to.equal(201);
             USER.id = response.body.id;
 
             const response2 = await superagent.get(`${serverUrl}/api/v1/users/${USER.id}/invite_link`)
                 .query({ access_token: owner.token })
                 .ok(() => true);
-            expect(response2.statusCode).to.equal(200);
+            expect(response2.status).to.equal(200);
 
             const response3 = await superagent.post(`${serverUrl}/api/v1/auth/setup_account`)
                 .send({
@@ -120,7 +120,7 @@ describe('Cloudron', function () {
                     displayName: USER.displayName
                 })
                 .ok(() => true);
-            expect(response3.statusCode).to.equal(409);
+            expect(response3.status).to.equal(409);
 
             const response4 = await superagent.post(`${serverUrl}/api/v1/auth/setup_account`)
                 .send({
@@ -129,20 +129,20 @@ describe('Cloudron', function () {
                     displayName: USER.displayName
                 })
                 .ok(() => true);
-            expect(response4.statusCode).to.equal(201);
+            expect(response4.status).to.equal(201);
             expect(response4.body.accessToken).to.be.a('string');
 
             const response5 = await superagent.get(`${serverUrl}/api/v1/users/${USER.id}`)
                 .query({ access_token: owner.token })
                 .ok(() => true);
 
-            expect(response5.statusCode).to.equal(200);
+            expect(response5.status).to.equal(200);
             expect(response5.body.username).to.equal(USER.username);
             expect(response5.body.displayName).to.equal(USER.displayName);
 
             const response6 = await superagent.post(`${serverUrl}/api/v1/auth/login`)
                 .send({ username: USER.username, password: USER.password });
-            expect(response6.statusCode).to.equal(200);
+            expect(response6.status).to.equal(200);
         });
 
         it('succeeds and does not overwrite pre-set username and display name if profiles are locked', async function () {
@@ -156,18 +156,18 @@ describe('Cloudron', function () {
             const response0 = await superagent.post(`${serverUrl}/api/v1/user_directory/profile_config`)
                 .query({ access_token: owner.token })
                 .send({ lockUserProfiles: true, mandatory2FA: false });
-            expect(response0.statusCode).to.equal(200);
+            expect(response0.status).to.equal(200);
 
             const response = await superagent.post(`${serverUrl}/api/v1/users`)
                 .query({ access_token: owner.token })
                 .send({ email: USER.email, username: 'presetup3', displayName: 'pre setup3' });
-            expect(response.statusCode).to.equal(201);
+            expect(response.status).to.equal(201);
             USER.id = response.body.id;
 
             const response2 = await superagent.get(`${serverUrl}/api/v1/users/${USER.id}/invite_link`)
                 .query({ access_token: owner.token })
                 .ok(() => true);
-            expect(response2.statusCode).to.equal(200);
+            expect(response2.status).to.equal(200);
 
             const response3 = await superagent.post(`${serverUrl}/api/v1/auth/setup_account`)
                 .send({
@@ -177,20 +177,20 @@ describe('Cloudron', function () {
                     displayName: USER.displayName // ignored
                 })
                 .ok(() => true);
-            expect(response3.statusCode).to.equal(201);
+            expect(response3.status).to.equal(201);
             expect(response3.body.accessToken).to.be.a('string');
 
             const response4 = await superagent.get(`${serverUrl}/api/v1/users/${USER.id}`)
                 .query({ access_token: owner.token })
                 .ok(() => true);
 
-            expect(response4.statusCode).to.equal(200);
+            expect(response4.status).to.equal(200);
             expect(response4.body.username).to.equal('presetup3'); // what the admin provided
             expect(response4.body.displayName).to.equal('pre setup3'); // what the admin provided
 
             const response5 = await superagent.post(`${serverUrl}/api/v1/auth/login`)
                 .send({ username: 'presetup3', password: USER.password });
-            expect(response5.statusCode).to.equal(200);
+            expect(response5.status).to.equal(200);
         });
     });
 
@@ -198,7 +198,7 @@ describe('Cloudron', function () {
         it('cannot login without body', async function () {
             const response = await superagent.post(`${serverUrl}/api/v1/auth/login`)
                 .ok(() => true);
-            expect(response.statusCode).to.equal(400);
+            expect(response.status).to.equal(400);
         });
 
         it('cannot login without username', async function () {
@@ -206,7 +206,7 @@ describe('Cloudron', function () {
                 .send({ password: owner.password })
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(400);
+            expect(response.status).to.equal(400);
         });
 
         it('cannot login without password', async function () {
@@ -214,7 +214,7 @@ describe('Cloudron', function () {
                 .send({ username: owner.username })
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(400);
+            expect(response.status).to.equal(400);
         });
 
         it('cannot login with empty username', async function () {
@@ -222,7 +222,7 @@ describe('Cloudron', function () {
                 .send({ username: '', password: owner.password })
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(400);
+            expect(response.status).to.equal(400);
         });
 
         it('cannot login with empty password', async function () {
@@ -230,7 +230,7 @@ describe('Cloudron', function () {
                 .send({ username: owner.username, password: '' })
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(400);
+            expect(response.status).to.equal(400);
         });
 
         it('cannot login with unknown username', async function () {
@@ -238,7 +238,7 @@ describe('Cloudron', function () {
                 .send({ username: 'somethingrandom', password: owner.password })
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(401);
+            expect(response.status).to.equal(401);
         });
 
         it('cannot login with unknown email', async function () {
@@ -246,7 +246,7 @@ describe('Cloudron', function () {
                 .send({ username: 'randomgemail', password: owner.password })
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(401);
+            expect(response.status).to.equal(401);
         });
 
         it('cannot login with wrong password', async function () {
@@ -254,14 +254,14 @@ describe('Cloudron', function () {
                 .send({ username: owner.username, password: owner.password.toUpperCase() })
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(401);
+            expect(response.status).to.equal(401);
         });
 
         it('can login with username', async function () {
             const response = await superagent.post(`${serverUrl}/api/v1/auth/login`)
                 .send({ username: owner.username, password: owner.password });
 
-            expect(response.statusCode).to.equal(200);
+            expect(response.status).to.equal(200);
             expect(new Date(response.body.expires).toString()).to.not.be('Invalid Date');
             expect(response.body.accessToken).to.be.a('string');
         });
@@ -270,7 +270,7 @@ describe('Cloudron', function () {
             const response = await superagent.post(`${serverUrl}/api/v1/auth/login`)
                 .send({ username: owner.username.toUpperCase(), password: owner.password });
 
-            expect(response.statusCode).to.equal(200);
+            expect(response.status).to.equal(200);
             expect(new Date(response.body.expires).toString()).to.not.be('Invalid Date');
             expect(response.body.accessToken).to.be.a('string');
         });
@@ -279,7 +279,7 @@ describe('Cloudron', function () {
             const response = await superagent.post(`${serverUrl}/api/v1/auth/login`)
                 .send({ username: owner.email, password: owner.password });
 
-            expect(response.statusCode).to.equal(200);
+            expect(response.status).to.equal(200);
             expect(new Date(response.body.expires).toString()).to.not.be('Invalid Date');
             expect(response.body.accessToken).to.be.a('string');
         });
@@ -288,7 +288,7 @@ describe('Cloudron', function () {
             const response = await superagent.post(`${serverUrl}/api/v1/auth/login`)
                 .send({ username: owner.email.toUpperCase(), password: owner.password });
 
-            expect(response.statusCode).to.equal(200);
+            expect(response.status).to.equal(200);
             expect(new Date(response.body.expires).toString()).to.not.be('Invalid Date');
             expect(response.body.accessToken).to.be.a('string');
         });
@@ -298,7 +298,7 @@ describe('Cloudron', function () {
         it('succeeds', async function () {
             const response = await superagent.get(`${serverUrl}/api/v1/cloudron/languages`);
 
-            expect(response.statusCode).to.equal(200);
+            expect(response.status).to.equal(200);
             expect(response.body.languages).to.be.an('array');
             expect(response.body.languages.indexOf('en')).to.not.equal(-1);
         });
diff --git a/src/routes/test/common.js b/src/routes/test/common.js
index 8b8c741e3..aa92dd13f 100644
--- a/src/routes/test/common.js
+++ b/src/routes/test/common.js
@@ -13,7 +13,7 @@ const apps = require('../../apps.js'),
     server = require('../../server.js'),
     settings = require('../../settings.js'),
     support = require('../../support.js'),
-    superagent = require('superagent'),
+    superagent = require('../../superagent.js'),
     tasks = require('../../tasks.js'),
     timers = require('timers/promises'),
     tokens = require('../../tokens.js');
diff --git a/src/routes/test/directoryserver-test.js b/src/routes/test/directoryserver-test.js
index fa32b59be..a277a6f19 100644
--- a/src/routes/test/directoryserver-test.js
+++ b/src/routes/test/directoryserver-test.js
@@ -7,7 +7,7 @@
 
 const common = require('./common.js'),
     expect = require('expect.js'),
-    superagent = require('superagent');
+    superagent = require('../../superagent.js');
 
 describe('Directory Server API', function () {
     const { setup, cleanup, serverUrl, owner } = common;
@@ -27,7 +27,7 @@ describe('Directory Server API', function () {
             const response = await superagent.get(`${serverUrl}/api/v1/directory_server/config`)
                 .query({ access_token: owner.token });
 
-            expect(response.statusCode).to.equal(200);
+            expect(response.status).to.equal(200);
             expect(response.body).to.eql(defaultConfig);
         });
 
@@ -40,7 +40,7 @@ describe('Directory Server API', function () {
                 .send(tmp)
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(400);
+            expect(response.status).to.equal(400);
         });
 
         it('cannot set directory_server config without secret', async function () {
@@ -53,7 +53,7 @@ describe('Directory Server API', function () {
                 .send(tmp)
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(400);
+            expect(response.status).to.equal(400);
         });
 
         it('cannot enable directory_server config with empty secret', async function () {
@@ -65,7 +65,7 @@ describe('Directory Server API', function () {
                 .send(tmp)
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(400);
+            expect(response.status).to.equal(400);
         });
 
         it('cannot enable directory_server config with empty allowlist', async function () {
@@ -78,7 +78,7 @@ describe('Directory Server API', function () {
                 .send(tmp)
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(400);
+            expect(response.status).to.equal(400);
         });
 
         it('can enable directory_server config', async function () {
@@ -91,7 +91,7 @@ describe('Directory Server API', function () {
                 .query({ access_token: owner.token })
                 .send(tmp);
 
-            expect(response.statusCode).to.equal(200);
+            expect(response.status).to.equal(200);
         });
 
         it('can get directory_server config', async function () {
@@ -101,7 +101,7 @@ describe('Directory Server API', function () {
             const response = await superagent.get(`${serverUrl}/api/v1/directory_server/config`)
                 .query({ access_token: owner.token });
 
-            expect(response.statusCode).to.equal(200);
+            expect(response.status).to.equal(200);
             expect(response.body).to.eql({ enabled: true, secret: 'ldapsecret', allowlist: '1.2.3.4' });
         });
 
@@ -115,7 +115,7 @@ describe('Directory Server API', function () {
                 .query({ access_token: owner.token })
                 .send(tmp);
 
-            expect(response.statusCode).to.equal(200);
+            expect(response.status).to.equal(200);
         });
     });
 });
diff --git a/src/routes/test/domains-test.js b/src/routes/test/domains-test.js
index a0fd45d46..d60835dd6 100644
--- a/src/routes/test/domains-test.js
+++ b/src/routes/test/domains-test.js
@@ -11,7 +11,7 @@ const child_process = require('child_process'),
     fs = require('fs'),
     path = require('path'),
     paths = require('../../paths.js'),
-    superagent = require('superagent');
+    superagent = require('../../superagent.js');
 
 const DOMAIN_0 = {
     domain: 'domain0.com',
@@ -45,7 +45,7 @@ describe('Domains API', function () {
                 .send({})
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(400);
+            expect(response.status).to.equal(400);
         });
 
         it('fails with invalid domain', async function () {
@@ -54,7 +54,7 @@ describe('Domains API', function () {
                 .send({ domain: 'abc' })
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(400);
+            expect(response.status).to.equal(400);
         });
 
         it('fails with unknown provider', async function () {
@@ -63,7 +63,7 @@ describe('Domains API', function () {
                 .send({ domain: 'cloudron.com', provider: 'doesnotexist', config: { }})
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(400);
+            expect(response.status).to.equal(400);
         });
 
         it('fails with invalid tlsConfig', async function () {
@@ -72,7 +72,7 @@ describe('Domains API', function () {
                 .send({ domain: 'cloudron.com', provider: 'noop', config: { }, tlsConfig: 'foobar' })
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(400);
+            expect(response.status).to.equal(400);
         });
 
         it('fails with unknown tls provider', async function () {
@@ -81,7 +81,7 @@ describe('Domains API', function () {
                 .send({ domain: 'cloudron.com', provider: 'noop', config: { }, tlsConfig: { provider: 'hello' }})
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(400);
+            expect(response.status).to.equal(400);
         });
 
         it('fails without token', async function () {
@@ -90,7 +90,7 @@ describe('Domains API', function () {
                 .send(DOMAIN_0)
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(401);
+            expect(response.status).to.equal(401);
         });
 
         it('fails for normal user', async function () {
@@ -99,7 +99,7 @@ describe('Domains API', function () {
                 .send(DOMAIN_0)
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(403);
+            expect(response.status).to.equal(403);
         });
 
         it('succeeds', async function () {
@@ -107,7 +107,7 @@ describe('Domains API', function () {
                 .query({ access_token: owner.token })
                 .send(DOMAIN_0);
 
-            expect(response.statusCode).to.equal(201);
+            expect(response.status).to.equal(201);
         });
 
         it('succeeds for second domain without zoneName', async function () {
@@ -115,7 +115,7 @@ describe('Domains API', function () {
                 .query({ access_token: owner.token })
                 .send(DOMAIN_1);
 
-            expect(response.statusCode).to.equal(201);
+            expect(response.status).to.equal(201);
         });
 
         it('fails for already added domain', async function () {
@@ -124,7 +124,7 @@ describe('Domains API', function () {
                 .send(DOMAIN_0)
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(409);
+            expect(response.status).to.equal(409);
         });
     });
 
@@ -133,7 +133,7 @@ describe('Domains API', function () {
             const response = await superagent.get(`${serverUrl}/api/v1/domains`)
                 .query({ access_token: owner.token });
 
-            expect(response.statusCode).to.equal(200);
+            expect(response.status).to.equal(200);
             expect(response.body.domains).to.be.an(Array);
             expect(response.body.domains.length).to.equal(3);
 
@@ -154,7 +154,7 @@ describe('Domains API', function () {
             const response = await superagent.get(`${serverUrl}/api/v1/domains`)
                 .query({ access_token: user.token });
 
-            expect(response.statusCode).to.equal(200);
+            expect(response.status).to.equal(200);
             expect(response.body.domains).to.be.an(Array);
             expect(response.body.domains.length).to.equal(3);
 
@@ -179,14 +179,14 @@ describe('Domains API', function () {
                 .query({ access_token: owner.token })
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(404);
+            expect(response.status).to.equal(404);
         });
 
         it('succeeds', async function () {
             const response = await superagent.get(`${serverUrl}/api/v1/domains/${DOMAIN_0.domain}`)
                 .query({ access_token: owner.token });
 
-            expect(response.statusCode).to.equal(200);
+            expect(response.status).to.equal(200);
             const d = response.body;
             expect(d.domain).to.equal(DOMAIN_0.domain);
             expect(d.tlsConfig).to.be.an('object');
@@ -201,7 +201,7 @@ describe('Domains API', function () {
                 .query({ access_token: user.token })
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(403);
+            expect(response.status).to.equal(403);
         });
     });
 
@@ -211,7 +211,7 @@ describe('Domains API', function () {
                 .query({ access_token: owner.token })
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(404);
+            expect(response.status).to.equal(404);
         });
 
         it('config fails as normal user', async function () {
@@ -220,7 +220,7 @@ describe('Domains API', function () {
                 .send(DOMAIN_0)
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(403);
+            expect(response.status).to.equal(403);
         });
 
         it('config succeeds as admin', async function () {
@@ -228,7 +228,7 @@ describe('Domains API', function () {
                 .query({ access_token: owner.token })
                 .send(DOMAIN_0);
 
-            expect(response.statusCode).to.equal(204);
+            expect(response.status).to.equal(204);
         });
 
         it('wellknown succeeds', async function () {
@@ -236,7 +236,7 @@ describe('Domains API', function () {
                 .query({ access_token: owner.token })
                 .send({ wellKnown: null });
 
-            expect(response.statusCode).to.equal(204);
+            expect(response.status).to.equal(204);
         });
 
         it('wellknown succeeds', async function () {
@@ -244,7 +244,7 @@ describe('Domains API', function () {
                 .query({ access_token: owner.token })
                 .send({ wellKnown: { service: 'some.service' } });
 
-            expect(response.statusCode).to.equal(204);
+            expect(response.status).to.equal(204);
         });
     });
 
@@ -271,7 +271,7 @@ describe('Domains API', function () {
                 .send(d)
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(400);
+            expect(response.status).to.equal(400);
         });
 
         it('cannot set certificate without key', async function () {
@@ -283,7 +283,7 @@ describe('Domains API', function () {
                 .send(d)
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(400);
+            expect(response.status).to.equal(400);
         });
 
         it('cannot set certificate with cert not being a string', async function () {
@@ -295,7 +295,7 @@ describe('Domains API', function () {
                 .send(d)
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(400);
+            expect(response.status).to.equal(400);
         });
 
         it('cannot set certificate with key not being a string', async function () {
@@ -307,7 +307,7 @@ describe('Domains API', function () {
                 .send(d)
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(400);
+            expect(response.status).to.equal(400);
         });
 
         it('cannot set non-fallback certificate', async function () {
@@ -319,7 +319,7 @@ describe('Domains API', function () {
                 .send(d)
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(400);
+            expect(response.status).to.equal(400);
         });
 
         it('can set fallback certificate', async function () {
@@ -330,7 +330,7 @@ describe('Domains API', function () {
                 .query({ access_token: owner.token })
                 .send(d);
 
-            expect(response.statusCode).to.equal(204);
+            expect(response.status).to.equal(204);
         });
 
         it('did set the certificate', async function () {
@@ -348,7 +348,7 @@ describe('Domains API', function () {
                 .query({ access_token: owner.token })
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(404);
+            expect(response.status).to.equal(404);
         });
 
         it('fails for normal user', async function () {
@@ -356,20 +356,20 @@ describe('Domains API', function () {
                 .query({ access_token: user.token })
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(403);
+            expect(response.status).to.equal(403);
         });
 
         it('succeeds as admin', async function () {
             const response = await superagent.del(`${serverUrl}/api/v1/domains/${DOMAIN_0.domain}`)
                 .query({ access_token: owner.token });
 
-            expect(response.statusCode).to.equal(204);
+            expect(response.status).to.equal(204);
 
             const response2 = await superagent.get(`${serverUrl}/api/v1/domains/${DOMAIN_0.domain}`)
                 .query({ access_token: owner.token })
                 .ok(() => true);
 
-            expect(response2.statusCode).to.equal(404);
+            expect(response2.status).to.equal(404);
         });
     });
 });
diff --git a/src/routes/test/eventlog-test.js b/src/routes/test/eventlog-test.js
index 1fcbea782..b2cca649b 100644
--- a/src/routes/test/eventlog-test.js
+++ b/src/routes/test/eventlog-test.js
@@ -10,7 +10,7 @@ const async = require('async'),
     common = require('./common.js'),
     eventlog = require('../../eventlog.js'),
     expect = require('expect.js'),
-    superagent = require('superagent');
+    superagent = require('../../superagent.js');
 
 describe('Eventlog API', function () {
     const { setup, cleanup, serverUrl, owner, user } = common;
@@ -35,14 +35,14 @@ describe('Eventlog API', function () {
             const response = await superagent.get(`${serverUrl}/api/v1/eventlog/someid`)
                 .query({ access_token: 'badtoken' })
                 .ok(() => true);
-            expect(response.statusCode).to.be(401);
+            expect(response.status).to.be(401);
         });
 
         it('fails for non-admin', async function () {
             const response = await superagent.get(`${serverUrl}/api/v1/eventlog/someid`)
                 .query({ access_token: user.token })
                 .ok(() => true);
-            expect(response.statusCode).to.equal(403);
+            expect(response.status).to.equal(403);
         });
 
         it('fails if not exists', async function () {
@@ -50,7 +50,7 @@ describe('Eventlog API', function () {
                 .query({ access_token: owner.token })
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(404);
+            expect(response.status).to.equal(404);
         });
 
         it('succeeds for admin', async function () {
@@ -58,7 +58,7 @@ describe('Eventlog API', function () {
                 .query({ access_token: owner.token })
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(200);
+            expect(response.status).to.equal(200);
             delete response.body.event.creationTime;
             expect(response.body.event).to.eql(EVENT_0);
         });
@@ -69,7 +69,7 @@ describe('Eventlog API', function () {
             const response = await superagent.get(`${serverUrl}/api/v1/eventlog`)
                 .query({ access_token: 'badtoken' })
                 .ok(() => true);
-            expect(response.statusCode).to.equal(401);
+            expect(response.status).to.equal(401);
         });
 
         it('fails for non-admin', async function () {
@@ -77,14 +77,14 @@ describe('Eventlog API', function () {
                 .query({ access_token: user.token, page: 1, per_page: 10 })
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(403);
+            expect(response.status).to.equal(403);
         });
 
         it('succeeds for admin', async function () {
             const response = await superagent.get(`${serverUrl}/api/v1/eventlog`)
                 .query({ access_token: owner.token, page: 1, per_page: 10 });
 
-            expect(response.statusCode).to.equal(200);
+            expect(response.status).to.equal(200);
             expect(response.body.eventlogs.length >= 2).to.be.ok(); // activate, user.add
         });
 
@@ -92,7 +92,7 @@ describe('Eventlog API', function () {
             const response = await superagent.get(`${serverUrl}/api/v1/eventlog`)
                 .query({ access_token: owner.token, page: 1, per_page: 10, action: 'cloudron.activate' });
 
-            expect(response.statusCode).to.equal(200);
+            expect(response.status).to.equal(200);
             expect(response.body.eventlogs.length).to.equal(1);
         });
 
@@ -100,7 +100,7 @@ describe('Eventlog API', function () {
             const response = await superagent.get(`${serverUrl}/api/v1/eventlog`)
                 .query({ access_token: owner.token, page: 1, per_page: 10, actions: 'cloudron.activate, user.add' });
 
-            expect(response.statusCode).to.equal(200);
+            expect(response.status).to.equal(200);
             expect(response.body.eventlogs.length).to.equal(4);
         });
 
@@ -108,7 +108,7 @@ describe('Eventlog API', function () {
             const response = await superagent.get(`${serverUrl}/api/v1/eventlog`)
                 .query({ access_token: owner.token, page: 1, per_page: 10, search: owner.email });
 
-            expect(response.statusCode).to.equal(200);
+            expect(response.status).to.equal(200);
             expect(response.body.eventlogs.length).to.equal(1);
         });
 
@@ -116,7 +116,7 @@ describe('Eventlog API', function () {
             const response = await superagent.get(`${serverUrl}/api/v1/eventlog`)
                 .query({ access_token: owner.token, page: 1, per_page: 10, search: owner.email, actions: 'cloudron.activate' });
 
-            expect(response.statusCode).to.equal(200);
+            expect(response.status).to.equal(200);
             expect(response.body.eventlogs.length).to.equal(0);
         });
     });
diff --git a/src/routes/test/externalldap-test.js b/src/routes/test/externalldap-test.js
index 94433f30e..dca91824e 100644
--- a/src/routes/test/externalldap-test.js
+++ b/src/routes/test/externalldap-test.js
@@ -7,7 +7,7 @@
 
 const common = require('./common.js'),
     expect = require('expect.js'),
-    superagent = require('superagent');
+    superagent = require('../../superagent.js');
 
 describe('External LDAP API', function () {
     const { setup, cleanup, serverUrl, owner } = common;
@@ -23,7 +23,7 @@ describe('External LDAP API', function () {
             const response = await superagent.get(`${serverUrl}/api/v1/external_ldap/config`)
                 .query({ access_token: owner.token });
 
-            expect(response.statusCode).to.equal(200);
+            expect(response.status).to.equal(200);
             expect(response.body).to.eql(defaultConfig);
         });
 
@@ -35,7 +35,7 @@ describe('External LDAP API', function () {
                 .query({ access_token: owner.token })
                 .send(config);
 
-            expect(response.statusCode).to.equal(200);
+            expect(response.status).to.equal(200);
         });
     });
 });
diff --git a/src/routes/test/groups-test.js b/src/routes/test/groups-test.js
index e3e72e485..873095aa8 100644
--- a/src/routes/test/groups-test.js
+++ b/src/routes/test/groups-test.js
@@ -8,7 +8,7 @@
 
 const common = require('./common.js'),
     expect = require('expect.js'),
-    superagent = require('superagent');
+    superagent = require('../../superagent.js');
 
 const GROUP_NAME = 'externals';
 let group0Object, group1Object;
@@ -24,7 +24,7 @@ describe('Groups API', function () {
             .send({ name: GROUP_NAME })
             .ok(() => true);
 
-        expect(response.statusCode).to.equal(401);
+        expect(response.status).to.equal(401);
     });
 
     it('create succeeds', async function () {
@@ -32,7 +32,7 @@ describe('Groups API', function () {
             .query({ access_token: owner.token })
             .send({ name: GROUP_NAME });
 
-        expect(response.statusCode).to.equal(201);
+        expect(response.status).to.equal(201);
         group0Object = response.body;
     });
 
@@ -42,7 +42,7 @@ describe('Groups API', function () {
             .send({ name: GROUP_NAME})
             .ok(() => true);
 
-        expect(response.statusCode).to.equal(409);
+        expect(response.status).to.equal(409);
     });
 
     it('can create another group', async function () {
@@ -50,7 +50,7 @@ describe('Groups API', function () {
             .query({ access_token: owner.token })
             .send({ name: 'group1'});
 
-        expect(response.statusCode).to.equal(201);
+        expect(response.status).to.equal(201);
         group1Object = response.body;
     });
 
@@ -60,7 +60,7 @@ describe('Groups API', function () {
             .send({ groupIds: [ group0Object.id, 'something' ]})
             .ok(() => true);
 
-        expect(response.statusCode).to.equal(404);
+        expect(response.status).to.equal(404);
     });
 
     it('can set groups of a user', async function () {
@@ -68,7 +68,7 @@ describe('Groups API', function () {
             .query({ access_token: owner.token })
             .send({ groupIds: [ group0Object.id, group1Object.id ]});
 
-        expect(response.statusCode).to.equal(204);
+        expect(response.status).to.equal(204);
     });
 
     it('cannot set duplicate groups for a user', async function () {
@@ -77,7 +77,7 @@ describe('Groups API', function () {
             .send({ groupIds: [ group0Object.id, group1Object.id, group0Object.id ]})
             .ok(() => true);
 
-        expect(response.statusCode).to.equal(409);
+        expect(response.status).to.equal(409);
     });
 
     it('can set users of a group', async function () {
@@ -85,7 +85,7 @@ describe('Groups API', function () {
             .query({ access_token: owner.token })
             .send({ userIds: [ owner.id, user.id ]});
 
-        expect(response.statusCode).to.equal(200);
+        expect(response.status).to.equal(200);
     });
 
     it('cannot set duplicate users of a group', async function () {
@@ -94,7 +94,7 @@ describe('Groups API', function () {
             .send({ userIds: [ owner.id, user.id, owner.id ]})
             .ok(() => true);
 
-        expect(response.statusCode).to.equal(409);
+        expect(response.status).to.equal(409);
     });
 
     it('cannot get non-existing group', async function () {
@@ -102,7 +102,7 @@ describe('Groups API', function () {
             .query({ access_token: owner.token })
             .ok(() => true);
 
-        expect(response.statusCode).to.equal(404);
+        expect(response.status).to.equal(404);
     });
 
     it('cannot get existing group with normal user', async function () {
@@ -110,14 +110,14 @@ describe('Groups API', function () {
             .query({ access_token: user.token })
             .ok(() => true);
 
-        expect(response.statusCode).to.equal(403);
+        expect(response.status).to.equal(403);
     });
 
     it('can get existing group', async function () {
         const response = await superagent.get(`${serverUrl}/api/v1/groups/${group0Object.id}`)
             .query({ access_token: owner.token });
 
-        expect(response.statusCode).to.equal(200);
+        expect(response.status).to.equal(200);
         expect(response.body.name).to.be(group0Object.name);
         expect(response.body.userIds.length).to.be(2);
         expect(response.body.userIds).to.contain(owner.id);
@@ -128,7 +128,7 @@ describe('Groups API', function () {
         const response = await superagent.get(`${serverUrl}/api/v1/groups`)
             .ok(() => true);
 
-        expect(response.statusCode).to.equal(401);
+        expect(response.status).to.equal(401);
     });
 
     it('cannot list groups as normal user', async function () {
@@ -136,14 +136,14 @@ describe('Groups API', function () {
             .query({ access_token: user.token })
             .ok(() => true);
 
-        expect(response.statusCode).to.equal(403);
+        expect(response.status).to.equal(403);
     });
 
     it('can list groups', async function () {
         const response = await superagent.get(`${serverUrl}/api/v1/groups`)
             .query({ access_token: owner.token });
 
-        expect(response.statusCode).to.equal(200);
+        expect(response.status).to.equal(200);
         expect(response.body.groups).to.be.an(Array);
         expect(response.body.groups.length).to.be(2);
         expect(response.body.groups[0].name).to.eql(group0Object.name);
@@ -156,7 +156,7 @@ describe('Groups API', function () {
             .send({ })
             .ok(() => true);
 
-        expect(response.statusCode).to.equal(400);
+        expect(response.status).to.equal(400);
     });
 
     it('can set invalid group name', async function () {
@@ -165,7 +165,7 @@ describe('Groups API', function () {
             .send({ name: '!group1-newname'})
             .ok(() => true);
 
-        expect(response.statusCode).to.equal(400);
+        expect(response.status).to.equal(400);
     });
 
     it('can set group name', async function () {
@@ -173,7 +173,7 @@ describe('Groups API', function () {
             .query({ access_token: owner.token })
             .send({ name: 'group1-newname'});
 
-        expect(response.statusCode).to.equal(200);
+        expect(response.status).to.equal(200);
     });
 
     it('cannot set unknown app access', async function () {
@@ -182,7 +182,7 @@ describe('Groups API', function () {
             .send({ appIds: ['app-id' ] })
             .ok(() => true);
 
-        expect(response.statusCode).to.equal(200); // bad appId is just ignored
+        expect(response.status).to.equal(200); // bad appId is just ignored
     });
 
     it('can set app access', async function () {
@@ -190,7 +190,7 @@ describe('Groups API', function () {
             .query({ access_token: owner.token })
             .send({ appIds: [app.id] });
 
-        expect(response.statusCode).to.equal(200);
+        expect(response.status).to.equal(200);
     });
 
     it('did set app access', async function () {
@@ -206,14 +206,14 @@ describe('Groups API', function () {
             .query({ access_token: owner.token })
             .send({ groupIds: [ group0Object.id ]});
 
-        expect(response.statusCode).to.equal(204);
+        expect(response.status).to.equal(204);
     });
 
     it('cannot remove without token', async function () {
         const response = await superagent.del(`${serverUrl}/api/v1/groups/externals`)
             .ok(() => true);
 
-        expect(response.statusCode).to.equal(401);
+        expect(response.status).to.equal(401);
     });
 
     it('can clear users of a group', async function () {
@@ -221,20 +221,20 @@ describe('Groups API', function () {
             .query({ access_token: owner.token })
             .send({ userIds: [ ]});
 
-        expect(response.statusCode).to.equal(200);
+        expect(response.status).to.equal(200);
     });
 
     it('can remove empty group', async function () {
         const response = await superagent.del(`${serverUrl}/api/v1/groups/${group1Object.id}`)
             .query({ access_token: owner.token });
 
-        expect(response.statusCode).to.equal(204);
+        expect(response.status).to.equal(204);
     });
 
     it('can remove non-empty group', async function () {
         const response = await superagent.del(`${serverUrl}/api/v1/groups/${group0Object.id}`)
             .query({ access_token: owner.token });
 
-        expect(response.statusCode).to.equal(204);
+        expect(response.status).to.equal(204);
     });
 });
diff --git a/src/routes/test/mail-test.js b/src/routes/test/mail-test.js
index 333c70f86..6eb06a11c 100644
--- a/src/routes/test/mail-test.js
+++ b/src/routes/test/mail-test.js
@@ -8,7 +8,7 @@
 const common = require('./common.js'),
     expect = require('expect.js'),
     mail = require('../../mail.js'),
-    superagent = require('superagent'),
+    superagent = require('../../superagent.js'),
     _ = require('../../underscore.js');
 
 describe('Mail API', function () {
@@ -29,14 +29,14 @@ describe('Mail API', function () {
                 .query({ access_token: owner.token })
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(404);
+            expect(response.status).to.equal(404);
         });
 
         it('can get domain', async function () {
             const response = await superagent.get(`${serverUrl}/api/v1/mail/${dashboardDomain}`)
                 .query({ access_token: owner.token });
 
-            expect(response.statusCode).to.equal(200);
+            expect(response.status).to.equal(200);
             expect(response.body.domain).to.equal(dashboardDomain);
             expect(response.body.enabled).to.equal(false);
             expect(response.body.mailFromValidation).to.equal(true);
@@ -52,7 +52,7 @@ describe('Mail API', function () {
         let dnsAnswerQueue = [];
         let dkimDomain, spfDomain, mxDomain, dmarcDomain;
 
-        before(function (done) {
+        before(async function () {
             const dig = require('../../dig.js');
 
             // replace dns resolveTxt()
@@ -72,14 +72,11 @@ describe('Mail API', function () {
             mxDomain = dashboardDomain;
             dmarcDomain = '_dmarc.' + dashboardDomain;
 
-            superagent.post(`${serverUrl}/api/v1/mail/${dashboardDomain}/enable`)
+            const response = await superagent.post(`${serverUrl}/api/v1/mail/${dashboardDomain}/enable`)
                 .query({ access_token: owner.token })
-                .send({ enabled: true })
-                .end(function (err, response) {
-                    expect(response.statusCode).to.equal(202);
+                .send({ enabled: true });
 
-                    done();
-                });
+            expect(response.status).to.be(202);
         });
 
         after(function (done) {
@@ -94,7 +91,7 @@ describe('Mail API', function () {
             const response = await superagent.get(`${serverUrl}/api/v1/mail/${dashboardDomain}/status`)
                 .query({ access_token: owner.token });
 
-            expect(response.statusCode).to.equal(200);
+            expect(response.status).to.equal(200);
         });
 
         function clearDnsAnswerQueue() {
@@ -110,7 +107,7 @@ describe('Mail API', function () {
 
             const response = await superagent.get(`${serverUrl}/api/v1/mail/${dashboardDomain}` + '/status')
                 .query({ access_token: owner.token });
-            expect(response.statusCode).to.equal(200);
+            expect(response.status).to.equal(200);
 
             expect(response.body.dns.dkim).to.be.an('object');
             expect(response.body.dns.dkim.domain).to.eql(dkimDomain);
@@ -156,7 +153,7 @@ describe('Mail API', function () {
             const response = await superagent.get(`${serverUrl}/api/v1/mail/${dashboardDomain}` + '/status')
                 .query({ access_token: owner.token });
 
-            expect(response.statusCode).to.equal(200);
+            expect(response.status).to.equal(200);
 
             expect(response.body.dns.spf).to.be.an('object');
             expect(response.body.dns.spf.expected).to.eql(`v=spf1 a:${dashboardFqdn} ~all`);
@@ -195,7 +192,7 @@ describe('Mail API', function () {
             const response = await superagent.get(`${serverUrl}/api/v1/mail/${dashboardDomain}` + '/status')
                 .query({ access_token: owner.token });
 
-            expect(response.statusCode).to.equal(200);
+            expect(response.status).to.equal(200);
 
             expect(response.body.dns.spf).to.be.an('object');
             expect(response.body.dns.spf.expected).to.eql(`v=spf1 a:${dashboardFqdn} a:random.com ~all`);
@@ -233,7 +230,7 @@ describe('Mail API', function () {
             const response = await superagent.get(`${serverUrl}/api/v1/mail/${dashboardDomain}/status`)
                 .query({ access_token: owner.token });
 
-            expect(response.statusCode).to.equal(200);
+            expect(response.status).to.equal(200);
 
             expect(response.body.dns.spf).to.be.an('object');
             expect(response.body.dns.spf.domain).to.eql(spfDomain);
@@ -251,7 +248,7 @@ describe('Mail API', function () {
             const response = await superagent.get(`${serverUrl}/api/v1/mail/${dashboardDomain}/status`)
                 .query({ access_token: owner.token });
 
-            expect(response.statusCode).to.equal(200);
+            expect(response.status).to.equal(200);
 
             expect(response.body.dns.dmarc).to.be.an('object');
             expect(response.body.dns.dmarc.expected).to.eql('v=DMARC1; p=reject; pct=100');
@@ -270,7 +267,7 @@ describe('Mail API', function () {
             const response = await superagent.get(`${serverUrl}/api/v1/mail/${dashboardDomain}` + '/status')
                 .query({ access_token: owner.token });
 
-            expect(response.statusCode).to.equal(200);
+            expect(response.status).to.equal(200);
 
             expect(response.body.dns.dkim).to.be.an('object');
             expect(response.body.dns.dkim.domain).to.eql(dkimDomain);
@@ -303,7 +300,7 @@ describe('Mail API', function () {
             const response = await superagent.get(`${serverUrl}/api/v1/mail/${dashboardDomain}`)
                 .query({ access_token: owner.token });
 
-            expect(response.statusCode).to.equal(200);
+            expect(response.status).to.equal(200);
             expect(response.body.mailFromValidation).to.eql(true);
         });
 
@@ -313,7 +310,7 @@ describe('Mail API', function () {
                 .send({ })
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(400);
+            expect(response.status).to.equal(400);
         });
 
         it('can set with enabled field', async function () {
@@ -321,7 +318,7 @@ describe('Mail API', function () {
                 .query({ access_token: owner.token })
                 .send({ enabled: false });
 
-            expect(response.statusCode).to.equal(202);
+            expect(response.status).to.equal(202);
         });
     });
 
@@ -329,7 +326,7 @@ describe('Mail API', function () {
         it('get catch_all succeeds', async function () {
             const response = await superagent.get(`${serverUrl}/api/v1/mail/${dashboardDomain}`)
                 .query({ access_token: owner.token });
-            expect(response.statusCode).to.equal(200);
+            expect(response.status).to.equal(200);
             expect(response.body.catchAll).to.eql([]);
         });
 
@@ -339,7 +336,7 @@ describe('Mail API', function () {
                 .send({ })
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(400);
+            expect(response.status).to.equal(400);
         });
 
         it('cannot set with bad addresses field', async function () {
@@ -348,7 +345,7 @@ describe('Mail API', function () {
                 .send({ addresses: [ 'user1', 123 ] })
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(400);
+            expect(response.status).to.equal(400);
         });
 
         it('cannot set with bad addresses field', async function () {
@@ -357,7 +354,7 @@ describe('Mail API', function () {
                 .send({ addresses: [ 'user1' ] })
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(400);
+            expect(response.status).to.equal(400);
         });
 
         it('set succeeds', async function () {
@@ -365,14 +362,14 @@ describe('Mail API', function () {
                 .query({ access_token: owner.token })
                 .send({ addresses: [ `user1@${dashboardDomain}` ] });
 
-            expect(response.statusCode).to.equal(202);
+            expect(response.status).to.equal(202);
         });
 
         it('get succeeds', async function () {
             const response = await superagent.get(`${serverUrl}/api/v1/mail/${dashboardDomain}`)
                 .query({ access_token: owner.token });
 
-            expect(response.statusCode).to.equal(200);
+            expect(response.status).to.equal(200);
             expect(response.body.catchAll).to.eql([ `user1@${dashboardDomain}` ]);
         });
     });
@@ -381,7 +378,7 @@ describe('Mail API', function () {
         it('get mail relay succeeds', async function () {
             const response = await superagent.get(`${serverUrl}/api/v1/mail/${dashboardDomain}`)
                 .query({ access_token: owner.token });
-            expect(response.statusCode).to.equal(200);
+            expect(response.status).to.equal(200);
             expect(response.body.relay).to.eql({ provider: 'cloudron-smtp' });
         });
 
@@ -391,7 +388,7 @@ describe('Mail API', function () {
                 .send({ })
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(400);
+            expect(response.status).to.equal(400);
         });
 
         it('cannot set with bad host', async function () {
@@ -400,7 +397,7 @@ describe('Mail API', function () {
                 .send({ provider: 'external-smtp', host: true })
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(400);
+            expect(response.status).to.equal(400);
         });
 
         it('set fails because mail server is unreachable', async function () {
@@ -409,7 +406,7 @@ describe('Mail API', function () {
                 .send({ provider: 'external-smtp', host: 'host', port: 25, username: 'u', password: 'p', tls: true })
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(400);
+            expect(response.status).to.equal(400);
         });
 
         it('get succeeds', async function () {
@@ -420,7 +417,7 @@ describe('Mail API', function () {
             const response = await superagent.get(`${serverUrl}/api/v1/mail/${dashboardDomain}`)
                 .query({ access_token: owner.token });
 
-            expect(response.statusCode).to.equal(200);
+            expect(response.status).to.equal(200);
             expect(_.omit(response.body.relay, ['password'])).to.eql(_.omit(relay, ['password']));
         });
     });
@@ -433,7 +430,7 @@ describe('Mail API', function () {
                 .send({ name: MAILBOX_NAME, ownerId: owner.id, ownerType: 'user', active: true, storageQuota: 10, messagesQuota: 20 })
                 .query({ access_token: owner.token });
 
-            expect(response.statusCode).to.equal(201);
+            expect(response.status).to.equal(201);
         });
 
         it('cannot add again', async function () {
@@ -442,7 +439,7 @@ describe('Mail API', function () {
                 .query({ access_token: owner.token })
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(409);
+            expect(response.status).to.equal(409);
         });
 
         it('get fails if not exist', async function () {
@@ -450,14 +447,14 @@ describe('Mail API', function () {
                 .query({ access_token: owner.token })
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(404);
+            expect(response.status).to.equal(404);
         });
 
         it('get succeeds', async function () {
             const response = await superagent.get(`${serverUrl}/api/v1/mail/${dashboardDomain}/mailboxes/${MAILBOX_NAME}`)
                 .query({ access_token: owner.token });
 
-            expect(response.statusCode).to.equal(200);
+            expect(response.status).to.equal(200);
             expect(response.body.mailbox).to.be.an('object');
             expect(response.body.mailbox.name).to.equal(MAILBOX_NAME);
             expect(response.body.mailbox.ownerId).to.equal(owner.id);
@@ -473,7 +470,7 @@ describe('Mail API', function () {
             const response = await superagent.get(`${serverUrl}/api/v1/mail/${dashboardDomain}/mailboxes`)
                 .query({ access_token: owner.token });
 
-            expect(response.statusCode).to.equal(200);
+            expect(response.status).to.equal(200);
             expect(response.body.mailboxes.length).to.eql(1);
             expect(response.body.mailboxes[0]).to.be.an('object');
             expect(response.body.mailboxes[0].name).to.equal(MAILBOX_NAME);
@@ -491,7 +488,7 @@ describe('Mail API', function () {
                 .query({ access_token: owner.token })
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(404);
+            expect(response.status).to.equal(404);
         });
 
         it('disable succeeds', async function () {
@@ -499,12 +496,12 @@ describe('Mail API', function () {
                 .send({ deleteMails: false })
                 .query({ access_token: owner.token });
 
-            expect(response.statusCode).to.equal(201);
+            expect(response.status).to.equal(201);
 
             const response2 = await superagent.get(`${serverUrl}/api/v1/mail/${dashboardDomain}` + '/mailboxes/' + MAILBOX_NAME)
                 .query({ access_token: owner.token })
                 .ok(() => true);
-            expect(response2.statusCode).to.equal(404);
+            expect(response2.status).to.equal(404);
         });
     });
 
@@ -520,7 +517,7 @@ describe('Mail API', function () {
                 .send({ name: MAILBOX_NAME, ownerId: owner.id, ownerType: 'user', active: true, storageQuota: 10, messagesQuota: 20 })
                 .query({ access_token: owner.token });
 
-            expect(response.statusCode).to.equal(201);
+            expect(response.status).to.equal(201);
         });
 
         it('set fails if aliases is missing', async function () {
@@ -528,7 +525,7 @@ describe('Mail API', function () {
                 .query({ access_token: owner.token })
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(400);
+            expect(response.status).to.equal(400);
         });
 
         it('set fails if user does not exist', async function () {
@@ -537,7 +534,7 @@ describe('Mail API', function () {
                 .query({ access_token: owner.token })
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(404);
+            expect(response.status).to.equal(404);
         });
 
         it('set fails if aliases is the wrong type', async function () {
@@ -546,7 +543,7 @@ describe('Mail API', function () {
                 .query({ access_token: owner.token })
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(400);
+            expect(response.status).to.equal(400);
         });
 
         it('set succeeds', async function () {
@@ -554,14 +551,14 @@ describe('Mail API', function () {
                 .send({ aliases: [{ name: 'hello*', domain: dashboardDomain}, {name: 'there', domain: dashboardDomain}] })
                 .query({ access_token: owner.token });
 
-            expect(response.statusCode).to.equal(202);
+            expect(response.status).to.equal(202);
         });
 
         it('get succeeds', async function () {
             const response = await superagent.get(`${serverUrl}/api/v1/mail/${dashboardDomain}` + '/mailboxes/' + MAILBOX_NAME + '/aliases')
                 .query({ access_token: owner.token });
 
-            expect(response.statusCode).to.equal(200);
+            expect(response.status).to.equal(200);
             expect(response.body.aliases).to.eql([{ name: 'hello*', domain: dashboardDomain}, {name: 'there', domain: dashboardDomain}]);
         });
 
@@ -570,7 +567,7 @@ describe('Mail API', function () {
                 .query({ access_token: owner.token })
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(404);
+            expect(response.status).to.equal(404);
         });
     });
 
@@ -586,7 +583,7 @@ describe('Mail API', function () {
                 .query({ access_token: owner.token })
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(400);
+            expect(response.status).to.equal(400);
         });
 
         it('add fails with invalid groupId', async function () {
@@ -595,7 +592,7 @@ describe('Mail API', function () {
                 .query({ access_token: owner.token })
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(400);
+            expect(response.status).to.equal(400);
         });
 
         it('add fails without members array', async function () {
@@ -604,7 +601,7 @@ describe('Mail API', function () {
                 .query({ access_token: owner.token })
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(400);
+            expect(response.status).to.equal(400);
         });
 
         it('add succeeds', async function () {
@@ -612,7 +609,7 @@ describe('Mail API', function () {
                 .send({ name: LIST_NAME, members: [ `admin2@${dashboardDomain}`, `${owner.username}@${dashboardDomain}`], membersOnly: false, active: true })
                 .query({ access_token: owner.token });
 
-            expect(response.statusCode).to.equal(201);
+            expect(response.status).to.equal(201);
         });
 
         it('add twice fails', async function () {
@@ -621,7 +618,7 @@ describe('Mail API', function () {
                 .query({ access_token: owner.token })
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(409);
+            expect(response.status).to.equal(409);
         });
 
         it('get fails if not exist', async function (){
@@ -629,14 +626,14 @@ describe('Mail API', function () {
                 .query({ access_token: owner.token })
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(404);
+            expect(response.status).to.equal(404);
         });
 
         it('get succeeds', async function () {
             const response = await superagent.get(`${serverUrl}/api/v1/mail/${dashboardDomain}/lists/${LIST_NAME}`)
                 .query({ access_token: owner.token });
 
-            expect(response.statusCode).to.equal(200);
+            expect(response.status).to.equal(200);
             expect(response.body.list).to.be.an('object');
             expect(response.body.list.name).to.equal(LIST_NAME);
             expect(response.body.list.ownerId).to.equal('admin');
@@ -650,7 +647,7 @@ describe('Mail API', function () {
             const response = await superagent.get(`${serverUrl}/api/v1/mail/${dashboardDomain}/lists`)
                 .query({ access_token: owner.token });
 
-            expect(response.statusCode).to.equal(200);
+            expect(response.status).to.equal(200);
             expect(response.body.lists).to.be.an(Array);
             expect(response.body.lists.length).to.equal(1);
             expect(response.body.lists[0].name).to.equal(LIST_NAME);
@@ -666,20 +663,20 @@ describe('Mail API', function () {
                 .query({ access_token: owner.token })
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(404);
+            expect(response.status).to.equal(404);
         });
 
         it('del succeeds', async function () {
             const response = await superagent.del(`${serverUrl}/api/v1/mail/${dashboardDomain}/lists/${LIST_NAME}`)
                 .query({ access_token: owner.token });
 
-            expect(response.statusCode).to.equal(204);
+            expect(response.status).to.equal(204);
 
             const response2 = await superagent.get(`${serverUrl}/api/v1/mail/${dashboardDomain}/lists/${LIST_NAME}`)
                 .query({ access_token: owner.token })
                 .ok(() => true);
 
-            expect(response2.statusCode).to.equal(404);
+            expect(response2.status).to.equal(404);
         });
     });
 });
diff --git a/src/routes/test/network-test.js b/src/routes/test/network-test.js
index 81e9325ef..a40229a48 100644
--- a/src/routes/test/network-test.js
+++ b/src/routes/test/network-test.js
@@ -7,7 +7,7 @@
 
 const common = require('./common.js'),
     expect = require('expect.js'),
-    superagent = require('superagent');
+    superagent = require('../../superagent.js');
 
 describe('Network API', function () {
     const { setup, cleanup, serverUrl, owner } = common;
@@ -20,7 +20,7 @@ describe('Network API', function () {
             const response = await superagent.get(`${serverUrl}/api/v1/network/dynamic_dns`)
                 .query({ access_token: owner.token });
 
-            expect(response.statusCode).to.equal(200);
+            expect(response.status).to.equal(200);
             expect(response.body.enabled).to.be(false);
         });
 
@@ -29,7 +29,7 @@ describe('Network API', function () {
                 .query({ access_token: owner.token })
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(400);
+            expect(response.status).to.equal(400);
         });
 
         it('cannot set', async function () {
@@ -38,14 +38,14 @@ describe('Network API', function () {
                 .send({ enabled: true })
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(200);
+            expect(response.status).to.equal(200);
         });
 
         it('get succeeds', async function () {
             const response = await superagent.get(`${serverUrl}/api/v1/network/dynamic_dns`)
                 .query({ access_token: owner.token });
 
-            expect(response.statusCode).to.equal(200);
+            expect(response.status).to.equal(200);
             expect(response.body.enabled).to.be(true);
         });
     });
diff --git a/src/routes/test/notifications-test.js b/src/routes/test/notifications-test.js
index 46953b9a3..c1a77d17e 100644
--- a/src/routes/test/notifications-test.js
+++ b/src/routes/test/notifications-test.js
@@ -8,7 +8,7 @@
 const common = require('./common.js'),
     expect = require('expect.js'),
     notifications = require('../../notifications.js'),
-    superagent = require('superagent');
+    superagent = require('../../superagent.js');
 
 describe('Notifications API', function () {
     const { setup, cleanup, serverUrl, owner } = common;
@@ -28,13 +28,13 @@ describe('Notifications API', function () {
         const response = await superagent.get(`${serverUrl}/api/v1/notifications/random`)
             .query({ access_token: owner.token })
             .ok(() => true);
-        expect(response.statusCode).to.equal(404);
+        expect(response.status).to.equal(404);
     });
 
     it('can get notification by id', async function () {
         const response = await superagent.get(`${serverUrl}/api/v1/notifications/${notificationIds[0]}`)
             .query({ access_token: owner.token });
-        expect(response.statusCode).to.equal(200);
+        expect(response.status).to.equal(200);
         expect(response.body.id).to.be(notificationIds[0]);
         expect(response.body.title).to.be('title 0');
         expect(response.body.message).to.be('message 0');
@@ -46,7 +46,7 @@ describe('Notifications API', function () {
             .query({ access_token: owner.token })
             .send({ acknowledged: true })
             .ok(() => true);
-        expect(response.statusCode).to.equal(204);
+        expect(response.status).to.equal(204);
 
         const result = await notifications.get(notificationIds[0]);
         expect(result.acknowledged).to.be(true);
@@ -57,20 +57,20 @@ describe('Notifications API', function () {
             .query({ access_token: owner.token })
             .send({ acknowledged: true })
             .ok(() => true);
-        expect(response.statusCode).to.equal(404);
+        expect(response.status).to.equal(404);
     });
 
     it('can list unread notifications', async function () {
         const response = await superagent.get(`${serverUrl}/api/v1/notifications`) // ?acknowledged=false is default
             .query({ access_token: owner.token });
-        expect(response.statusCode).to.equal(200);
+        expect(response.status).to.equal(200);
         expect(response.body.notifications.length).to.be.greaterThan(2);
     });
 
     it('can list read notifications', async function () {
         const response = await superagent.get(`${serverUrl}/api/v1/notifications?acknowledged=true`)
             .query({ access_token: owner.token });
-        expect(response.statusCode).to.equal(200);
+        expect(response.status).to.equal(200);
         expect(response.body.notifications.length).to.be(1);
         expect(response.body.notifications[0].id).to.be(notificationIds[0]);
         expect(response.body.notifications[0].title).to.be('title 0');
diff --git a/src/routes/test/oidc-test.js b/src/routes/test/oidc-test.js
index 2983db887..d6e0fb4b6 100644
--- a/src/routes/test/oidc-test.js
+++ b/src/routes/test/oidc-test.js
@@ -8,7 +8,7 @@
 
 const common = require('./common.js'),
     expect = require('expect.js'),
-    superagent = require('superagent');
+    superagent = require('../../superagent.js');
 
 const CLIENT_0 = {
     id: 'client0',
@@ -37,7 +37,7 @@ describe('OpenID connect clients API', function () {
             .send(CLIENT_0)
             .ok(() => true);
 
-        expect(response.statusCode).to.equal(401);
+        expect(response.status).to.equal(401);
     });
 
     it('create succeeds', async function () {
@@ -45,7 +45,7 @@ describe('OpenID connect clients API', function () {
             .query({ access_token: owner.token })
             .send(CLIENT_0);
 
-        expect(response.statusCode).to.equal(201);
+        expect(response.status).to.equal(201);
         CLIENT_0.id = response.body.id;
         CLIENT_0.secret = response.body.secret;
     });
@@ -55,7 +55,7 @@ describe('OpenID connect clients API', function () {
             .query({ access_token: owner.token })
             .send(CLIENT_1);
 
-        expect(response.statusCode).to.equal(201);
+        expect(response.status).to.equal(201);
         CLIENT_1.id = response.body.id;
         CLIENT_1.secret = response.body.secret;
     });
@@ -65,7 +65,7 @@ describe('OpenID connect clients API', function () {
             .query({ access_token: owner.token })
             .ok(() => true);
 
-        expect(response.statusCode).to.equal(404);
+        expect(response.status).to.equal(404);
     });
 
     it('cannot get existing client with normal user', async function () {
@@ -73,14 +73,14 @@ describe('OpenID connect clients API', function () {
             .query({ access_token: user.token })
             .ok(() => true);
 
-        expect(response.statusCode).to.equal(403);
+        expect(response.status).to.equal(403);
     });
 
     it('can get existing client', async function () {
         const response = await superagent.get(`${serverUrl}/api/v1/oidc/clients/${CLIENT_1.id}`)
             .query({ access_token: owner.token });
 
-        expect(response.statusCode).to.equal(200);
+        expect(response.status).to.equal(200);
         expect(response.body.id).to.equal(CLIENT_1.id);
         expect(response.body.secret).to.equal(CLIENT_1.secret);
         expect(response.body.loginRedirectUri).to.equal(CLIENT_1.loginRedirectUri);
@@ -93,14 +93,14 @@ describe('OpenID connect clients API', function () {
             .send(CLIENT_0)
             .ok(() => true);
 
-        expect(response.statusCode).to.equal(404);
+        expect(response.status).to.equal(404);
     });
 
     it('cannot list clients without token', async function () {
         const response = await superagent.get(`${serverUrl}/api/v1/oidc/clients`)
             .ok(() => true);
 
-        expect(response.statusCode).to.equal(401);
+        expect(response.status).to.equal(401);
     });
 
     it('cannot list clients as normal user', async function () {
@@ -108,14 +108,14 @@ describe('OpenID connect clients API', function () {
             .query({ access_token: user.token })
             .ok(() => true);
 
-        expect(response.statusCode).to.equal(403);
+        expect(response.status).to.equal(403);
     });
 
     it('can list clients', async function () {
         const response = await superagent.get(`${serverUrl}/api/v1/oidc/clients`)
             .query({ access_token: owner.token });
 
-        expect(response.statusCode).to.equal(200);
+        expect(response.status).to.equal(200);
         expect(response.body.clients).to.be.an(Array);
         expect(response.body.clients.length).to.be(2);
         expect(response.body.clients[0].id).to.eql(CLIENT_0.id);
@@ -128,7 +128,7 @@ describe('OpenID connect clients API', function () {
             .send({ loginRedirectUri: CLIENT_0.loginRedirectUri })
             .ok(() => true);
 
-        expect(response.statusCode).to.equal(400);
+        expect(response.status).to.equal(400);
     });
 
     it('cannot update client without loginRedirectUri', async function () {
@@ -137,20 +137,20 @@ describe('OpenID connect clients API', function () {
             .send({})
             .ok(() => true);
 
-        expect(response.statusCode).to.equal(400);
+        expect(response.status).to.equal(400);
     });
 
     it('cannot remove without token', async function () {
         const response = await superagent.del(`${serverUrl}/api/v1/oidc/clients/${CLIENT_0.id}`)
             .ok(() => true);
 
-        expect(response.statusCode).to.equal(401);
+        expect(response.status).to.equal(401);
     });
 
     it('can remove empty group', async function () {
         const response = await superagent.del(`${serverUrl}/api/v1/oidc/clients/${CLIENT_0.id}`)
             .query({ access_token: owner.token });
 
-        expect(response.statusCode).to.equal(204);
+        expect(response.status).to.equal(204);
     });
 });
diff --git a/src/routes/test/profile-test.js b/src/routes/test/profile-test.js
index 52d7b12a2..24062c32b 100644
--- a/src/routes/test/profile-test.js
+++ b/src/routes/test/profile-test.js
@@ -9,7 +9,7 @@
 const common = require('./common.js'),
     expect = require('expect.js'),
     speakeasy = require('speakeasy'),
-    superagent = require('superagent'),
+    superagent = require('../../superagent.js'),
     fs = require('fs'),
     path = require('path'),
     paths = require('../../paths.js'),
@@ -26,7 +26,7 @@ describe('Profile API', function () {
             const response = await superagent.get(`${serverUrl}/api/v1/profile`)
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(401);
+            expect(response.status).to.equal(401);
         });
 
         it('fails with empty token', async function () {
@@ -34,7 +34,7 @@ describe('Profile API', function () {
                 .query({ access_token: '' })
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(401);
+            expect(response.status).to.equal(401);
         });
 
         it('fails with invalid token', async function () {
@@ -42,14 +42,14 @@ describe('Profile API', function () {
                 .query({ access_token: 'some token' })
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(401);
+            expect(response.status).to.equal(401);
         });
 
         it('succeeds', async function () {
             const response = await superagent.get(`${serverUrl}/api/v1/profile`)
                 .query({ access_token: owner.token });
 
-            expect(response.statusCode).to.equal(200);
+            expect(response.status).to.equal(200);
             expect(response.body.username).to.equal(owner.username.toLowerCase());
             expect(response.body.email).to.equal(owner.email.toLowerCase());
             expect(response.body.fallbackEmail).to.equal('');
@@ -67,7 +67,7 @@ describe('Profile API', function () {
                 .query({ access_token: token.accessToken })
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(401);
+            expect(response.status).to.equal(401);
         });
 
         it('fails with invalid token in auth header', async function () {
@@ -75,13 +75,13 @@ describe('Profile API', function () {
                 .set('Authorization', 'Bearer ' + 'x' + owner.token)
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(401);
+            expect(response.status).to.equal(401);
         });
 
         it('succeeds with token in auth header', async function () {
             const response = await superagent.get(`${serverUrl}/api/v1/profile`).set('Authorization', 'Bearer ' + owner.token);
 
-            expect(response.statusCode).to.equal(200);
+            expect(response.status).to.equal(200);
             expect(response.body.username).to.equal(owner.username.toLowerCase());
             expect(response.body.email).to.equal(owner.email.toLowerCase());
             expect(response.body.displayName).to.be.a('string');
@@ -96,7 +96,7 @@ describe('Profile API', function () {
                 .send({ email: 'newemail@example.com' })
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(401);
+            expect(response.status).to.equal(401);
         });
 
         it('change email fails due to missing password', async function () {
@@ -105,7 +105,7 @@ describe('Profile API', function () {
                 .send({ email: 'newemail@example.com' })
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(400);
+            expect(response.status).to.equal(400);
         });
 
         it('change email fails due to invalid password', async function () {
@@ -114,7 +114,7 @@ describe('Profile API', function () {
                 .send({ email: 'foo@bar.com', password: 'this is wrong' })
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(412);
+            expect(response.status).to.equal(412);
         });
 
         it('change email fails due to invalid email', async function () {
@@ -123,7 +123,7 @@ describe('Profile API', function () {
                 .send({ email: 'foo@bar' })
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(400);
+            expect(response.status).to.equal(400);
         });
 
         it('change email succeeds', async function () {
@@ -131,12 +131,12 @@ describe('Profile API', function () {
                 .query({ access_token: owner.token })
                 .send({ email: 'newemail@example.Com', password: owner.password });
 
-            expect(response.statusCode).to.equal(204);
+            expect(response.status).to.equal(204);
 
             const response2 = await superagent.get(`${serverUrl}/api/v1/profile`)
                 .query({ access_token: owner.token });
 
-            expect(response2.statusCode).to.equal(200);
+            expect(response2.status).to.equal(200);
             expect(response2.body.username).to.equal(owner.username);
             expect(response2.body.email).to.equal('newemail@example.com'); // lower cased
             expect(response2.body.displayName).to.equal('');
@@ -150,7 +150,7 @@ describe('Profile API', function () {
                 .send({ fallbackEmail: 'newemail@example.com' })
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(400);
+            expect(response.status).to.equal(400);
         });
 
         it('change fallback email fails due to invalid password', async function () {
@@ -159,7 +159,7 @@ describe('Profile API', function () {
                 .send({ fallbackEmail: 'foo@bar.com', password: 'this is wrong' })
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(412);
+            expect(response.status).to.equal(412);
         });
 
         it('change fallback email succeeds', async function () {
@@ -167,12 +167,12 @@ describe('Profile API', function () {
                 .query({ access_token: owner.token })
                 .send({ fallbackEmail: 'NewFallbackemail@example.com', password: owner.password });
 
-            expect(response.statusCode).to.equal(204);
+            expect(response.status).to.equal(204);
 
             const response2 = await superagent.get(`${serverUrl}/api/v1/profile`)
                 .query({ access_token: owner.token });
 
-            expect(response2.statusCode).to.equal(200);
+            expect(response2.status).to.equal(200);
             expect(response2.body.username).to.equal(owner.username);
             expect(response2.body.fallbackEmail).to.equal('newfallbackemail@example.com'); // lowercase
         });
@@ -184,11 +184,11 @@ describe('Profile API', function () {
                 .query({ access_token: owner.token })
                 .send({ displayName: 'Agent Smith' });
 
-            expect(response.statusCode).to.equal(204);
+            expect(response.status).to.equal(204);
 
             const response2 = await superagent.get(`${serverUrl}/api/v1/profile`)
                 .query({ access_token: owner.token });
-            expect(response2.statusCode).to.equal(200);
+            expect(response2.status).to.equal(200);
             expect(response2.body.username).to.equal(owner.username);
             expect(response2.body.email).to.equal('newemail@example.com'); // lower cased
             expect(response2.body.displayName).to.equal('Agent Smith');
@@ -202,7 +202,7 @@ describe('Profile API', function () {
                 .send({ newPassword: 'some wrong password' })
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(400);
+            expect(response.status).to.equal(400);
         });
 
         it('fails due to missing new password', async function () {
@@ -211,7 +211,7 @@ describe('Profile API', function () {
                 .send({ password: owner.password })
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(400);
+            expect(response.status).to.equal(400);
         });
 
         it('fails due to wrong password', async function () {
@@ -220,7 +220,7 @@ describe('Profile API', function () {
                 .send({ password: 'some wrong password', newPassword: 'MOre#$%34' })
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(412);
+            expect(response.status).to.equal(412);
         });
 
         it('fails due to invalid password', async function () {
@@ -229,7 +229,7 @@ describe('Profile API', function () {
                 .send({ password: owner.password, newPassword: 'five' })
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(400);
+            expect(response.status).to.equal(400);
         });
 
         it('succeeds', async function () {
@@ -237,7 +237,7 @@ describe('Profile API', function () {
                 .query({ access_token: owner.token })
                 .send({ password: owner.password, newPassword: 'MOre#$%34' });
 
-            expect(response.statusCode).to.equal(204);
+            expect(response.status).to.equal(204);
         });
     });
 
@@ -264,7 +264,7 @@ describe('Profile API', function () {
                 .send({ username: user.username, password: user.password })
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(401);
+            expect(response.status).to.equal(401);
         });
 
         it('fails due to wrong token', async function () {
@@ -272,7 +272,7 @@ describe('Profile API', function () {
                 .send({ username: user.username, password: user.password, totpToken: '12345' })
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(401);
+            expect(response.status).to.equal(401);
         });
 
         it('succeeds', async function () {
@@ -284,7 +284,7 @@ describe('Profile API', function () {
             const response = await superagent.post(`${serverUrl}/api/v1/auth/login`)
                 .send({ username: user.username, password: user.password, totpToken: totpToken });
 
-            expect(response.statusCode).to.equal(200);
+            expect(response.status).to.equal(200);
             expect(response.body).to.be.an(Object);
             expect(response.body.accessToken).to.be.a('string');
         });
@@ -299,7 +299,7 @@ describe('Profile API', function () {
             const response = await superagent.post(`${serverUrl}/api/v1/auth/login`)
                 .send({ username: user.username, password: user.password });
 
-            expect(response.statusCode).to.equal(200);
+            expect(response.status).to.equal(200);
             expect(response.body).to.be.an(Object);
             expect(response.body.accessToken).to.be.a('string');
         });
@@ -324,7 +324,7 @@ describe('Profile API', function () {
 
             customAvatarSize = require('fs').readFileSync('./logo.png').length;
 
-            expect(response.statusCode).to.be(202);
+            expect(response.status).to.be(202);
         });
 
         it('did set custom avatar', async function () {
@@ -336,7 +336,7 @@ describe('Profile API', function () {
                 .ok(() => true);
 
             expect(parseInt(response2.headers['content-length'])).to.equal(customAvatarSize);
-            expect(response2.statusCode).to.equal(200);
+            expect(response2.status).to.equal(200);
         });
 
         it('can set gravatar', async function () {
@@ -344,7 +344,7 @@ describe('Profile API', function () {
                 .query({ access_token: user.token })
                 .send({ avatar: 'gravatar' });
 
-            expect(response.statusCode).to.be(202);
+            expect(response.status).to.be(202);
         });
 
         it('did set gravatar', async function () {
@@ -359,7 +359,7 @@ describe('Profile API', function () {
                 .query({ access_token: user.token })
                 .send({ avatar: '' });
 
-            expect(response.statusCode).to.be(202);
+            expect(response.status).to.be(202);
         });
 
         it('did unset avatar', async function () {
@@ -378,7 +378,7 @@ describe('Profile API', function () {
                 .query({ access_token: user.token })
                 .send({ language: 'ta' })
                 .ok(() => true);
-            expect(response.statusCode).to.be(400);
+            expect(response.status).to.be(400);
         });
 
         it('fails to set bad language', async function () {
@@ -386,7 +386,7 @@ describe('Profile API', function () {
                 .query({ access_token: user.token })
                 .send({ language: 123 })
                 .ok(() => true);
-            expect(response.statusCode).to.be(400);
+            expect(response.status).to.be(400);
         });
 
         it('fails to set unknown language', async function () {
@@ -394,14 +394,14 @@ describe('Profile API', function () {
                 .query({ access_token: user.token })
                 .send({ language: 'ta' })
                 .ok(() => true);
-            expect(response.statusCode).to.be(400);
+            expect(response.status).to.be(400);
         });
 
         it('set valid language', async function () {
             const response = await superagent.post(`${serverUrl}/api/v1/profile/language`)
                 .query({ access_token: user.token })
                 .send({ language: 'en' });
-            expect(response.statusCode).to.be(204);
+            expect(response.status).to.be(204);
         });
 
         it('did set language', async function () {
@@ -413,7 +413,7 @@ describe('Profile API', function () {
             const response = await superagent.post(`${serverUrl}/api/v1/profile/language`)
                 .query({ access_token: user.token })
                 .send({ language: '' });
-            expect(response.statusCode).to.be(204);
+            expect(response.status).to.be(204);
         });
 
         it('did reset language', async function () {
diff --git a/src/routes/test/provision-test.js b/src/routes/test/provision-test.js
index 43df3a01f..e7aee85c5 100644
--- a/src/routes/test/provision-test.js
+++ b/src/routes/test/provision-test.js
@@ -8,7 +8,7 @@
 const common = require('./common.js');
 
 const expect = require('expect.js'),
-    superagent = require('superagent'),
+    superagent = require('../../superagent.js'),
     timers = require('timers/promises');
 
 const DOMAIN = 'example-server-test.com';
@@ -39,7 +39,7 @@ describe('Provision', function () {
                 .send({ domainConfig: { domain: DOMAIN, config: {} } })
                 .ok(() => true);
 
-            expect(response.statusCode).to.eql(400);
+            expect(response.status).to.eql(400);
         });
 
         it('fails with invalid provider', async function () {
@@ -47,7 +47,7 @@ describe('Provision', function () {
                 .send({ domainConfig: { provider: 'foobar', domain: DOMAIN, config: {} } })
                 .ok(() => true);
 
-            expect(response.statusCode).to.eql(400);
+            expect(response.status).to.eql(400);
         });
 
         it('fails with missing domain', async function () {
@@ -55,7 +55,7 @@ describe('Provision', function () {
                 .send({ domainConfig: { provider: 'noop', config: {} } })
                 .ok(() => true);
 
-            expect(response.statusCode).to.eql(400);
+            expect(response.status).to.eql(400);
         });
 
         it('fails with invalid domain', async function () {
@@ -63,7 +63,7 @@ describe('Provision', function () {
                 .send({ domainConfig: { provider: 'noop', domain: '.foo', config: {} } })
                 .ok(() => true);
 
-            expect(response.statusCode).to.eql(400);
+            expect(response.status).to.eql(400);
         });
 
         it('fails with invalid config', async function () {
@@ -71,7 +71,7 @@ describe('Provision', function () {
                 .send({ domainConfig: { provider: 'noop', domain: DOMAIN, config: 'not an object' } })
                 .ok(() => true);
 
-            expect(response.statusCode).to.eql(400);
+            expect(response.status).to.eql(400);
         });
 
         it('fails with invalid zoneName', async function () {
@@ -79,7 +79,7 @@ describe('Provision', function () {
                 .send({ domainConfig: { provider: 'noop', domain: DOMAIN, config: {}, zoneName: 1337 } })
                 .ok(() => true);
 
-            expect(response.statusCode).to.eql(400);
+            expect(response.status).to.eql(400);
         });
 
         it('fails with invalid tlsConfig', async function () {
@@ -87,7 +87,7 @@ describe('Provision', function () {
                 .send({ domainConfig: { provider: 'noop', domain: DOMAIN, config: {}, tlsConfig: 'foobar' } })
                 .ok(() => true);
 
-            expect(response.statusCode).to.eql(400);
+            expect(response.status).to.eql(400);
         });
 
         it('fails with invalid tlsConfig provider', async function () {
@@ -95,7 +95,7 @@ describe('Provision', function () {
                 .send({ domainConfig: { provider: 'noop', domain: DOMAIN, config: {}, tlsConfig: { provider: 1337 } } })
                 .ok(() => true);
 
-            expect(response.statusCode).to.eql(400);
+            expect(response.status).to.eql(400);
         });
 
         it('succeeds', async function () {
@@ -103,7 +103,7 @@ describe('Provision', function () {
                 .send({ domainConfig: { provider: 'noop', domain: DOMAIN, adminFqdn: 'my.' + DOMAIN, config: {}, tlsConfig: { provider: 'fallback' } } })
                 .ok(() => true);
 
-            expect(response.statusCode).to.eql(200);
+            expect(response.status).to.eql(200);
 
             await waitForSetup();
         });
@@ -113,7 +113,7 @@ describe('Provision', function () {
                 .send({ domainConfig: { provider: 'noop', domain: DOMAIN, adminFqdn: 'my.' + DOMAIN, config: {}, tlsConfig: { provider: 'fallback' } } })
                 .ok(() => true);
 
-            expect(response.statusCode).to.eql(200);
+            expect(response.status).to.eql(200);
 
             await waitForSetup();
         });
@@ -122,7 +122,7 @@ describe('Provision', function () {
     describe('Activation', function () {
         it('device is in first time mode', async function () {
             const response = await superagent.get(`${serverUrl}/api/v1/provision/status`);
-            expect(response.statusCode).to.equal(200);
+            expect(response.status).to.equal(200);
             expect(response.body.activated).to.not.be.ok();
             expect(response.body.version).to.be.ok();
             expect(response.body.adminFqdn).to.be.ok(); // dashboard is setup at this point
@@ -133,7 +133,7 @@ describe('Provision', function () {
                 .send({ password: owner.password, email: owner.email })
                 .ok(() => true);
 
-            expect(response.statusCode).to.eql(400);
+            expect(response.status).to.eql(400);
         });
 
         it('fails with invalid username', async function () {
@@ -141,7 +141,7 @@ describe('Provision', function () {
                 .send({ username: '?this.is-not!valid', password: owner.password, email: owner.email })
                 .ok(() => true);
 
-            expect(response.statusCode).to.eql(400);
+            expect(response.status).to.eql(400);
         });
 
         it('fails due to empty username', async function () {
@@ -149,7 +149,7 @@ describe('Provision', function () {
                 .send({ username: '', password: owner.password, email: owner.email })
                 .ok(() => true);
 
-            expect(response.statusCode).to.eql(400);
+            expect(response.status).to.eql(400);
         });
 
         it('fails without email', async function () {
@@ -157,7 +157,7 @@ describe('Provision', function () {
                 .send({ username: owner.username, password: owner.password })
                 .ok(() => true);
 
-            expect(response.statusCode).to.eql(400);
+            expect(response.status).to.eql(400);
         });
 
         it('fails due to empty email', async function () {
@@ -165,7 +165,7 @@ describe('Provision', function () {
                 .send({ username: owner.username, password: owner.password, email: '' })
                 .ok(() => true);
 
-            expect(response.statusCode).to.eql(400);
+            expect(response.status).to.eql(400);
         });
 
         it('fails due to invalid email', async function () {
@@ -173,7 +173,7 @@ describe('Provision', function () {
                 .send({ username: owner.username, password: owner.password, email: 'invalidemail' })
                 .ok(() => true);
 
-            expect(response.statusCode).to.eql(400);
+            expect(response.status).to.eql(400);
         });
 
         it('fails without password', async function () {
@@ -181,7 +181,7 @@ describe('Provision', function () {
                 .send({ username: owner.password.username, email: owner.email })
                 .ok(() => true);
 
-            expect(response.statusCode).to.eql(400);
+            expect(response.status).to.eql(400);
         });
 
         it('fails due to empty password', async function () {
@@ -189,7 +189,7 @@ describe('Provision', function () {
                 .send({ username: owner.username, password: '', email: owner.email })
                 .ok(() => true);
 
-            expect(response.statusCode).to.eql(400);
+            expect(response.status).to.eql(400);
         });
 
         it('fails with invalid password', async function () {
@@ -197,7 +197,7 @@ describe('Provision', function () {
                 .send({ username: owner.username, password: 'short', email: owner.email })
                 .ok(() => true);
 
-            expect(response.statusCode).to.eql(400);
+            expect(response.status).to.eql(400);
         });
 
         it('fails due to wrong displayName type', async function () {
@@ -205,14 +205,14 @@ describe('Provision', function () {
                 .send({ username: owner.username, password: owner.password, email: owner.email, displayName: 1234 })
                 .ok(() => true);
 
-            expect(response.statusCode).to.eql(400);
+            expect(response.status).to.eql(400);
         });
 
         it('succeeds', async function () {
             const response = await superagent.post(`${serverUrl}/api/v1/provision/activate`)
                 .send({ username: owner.username, password: owner.password, email: owner.email, displayName: owner.displayName });
 
-            expect(response.statusCode).to.equal(201);
+            expect(response.status).to.equal(201);
             expect(response.body.token).to.be.a('string');
         });
 
@@ -221,7 +221,7 @@ describe('Provision', function () {
                 .send({ username: owner.username, password: owner.password, email: owner.email, displayName: owner.displayName })
                 .ok(() => true);
 
-            expect(response.statusCode).to.eql(405); // route unavailable post activation
+            expect(response.status).to.eql(405); // route unavailable post activation
         });
 
         it('seutp fails after activation', async function () {
@@ -229,12 +229,12 @@ describe('Provision', function () {
                 .send({ domainConfig: { provider: 'noop', domain: DOMAIN, adminFqdn: 'my.' + DOMAIN, config: {}, tlsConfig: { provider: 'fallback' } } })
                 .ok(() => true);
 
-            expect(response.statusCode).to.eql(405);
+            expect(response.status).to.eql(405);
         });
 
         it('device left first time mode', async function () {
             const response = await superagent.get(`${serverUrl}/api/v1/provision/status`);
-            expect(response.statusCode).to.equal(200);
+            expect(response.status).to.equal(200);
             expect(response.body.activated).to.be.ok();
         });
     });
diff --git a/src/routes/test/support-test.js b/src/routes/test/support-test.js
index d34ea5c62..84d99406b 100644
--- a/src/routes/test/support-test.js
+++ b/src/routes/test/support-test.js
@@ -10,7 +10,7 @@ const common = require('./common.js'),
     fs = require('fs'),
     nock = require('nock'),
     support = require('../../support.js'),
-    superagent = require('superagent');
+    superagent = require('../../superagent.js');
 
 describe('Support API', function () {
     const { setup, cleanup, serverUrl, owner, mockApiServerOrigin, appstoreToken, user, admin } = common;
@@ -25,7 +25,7 @@ describe('Support API', function () {
         it('get remote support', async function () {
             const response = await superagent.get(`${serverUrl}/api/v1/support/remote_support`)
                 .query({ access_token: owner.token });
-            expect(response.statusCode).to.equal(200);
+            expect(response.status).to.equal(200);
             expect(response.body.enabled).to.be(false);
         });
 
@@ -34,7 +34,7 @@ describe('Support API', function () {
                 .query({ access_token: owner.token })
                 .send({ enabled: true });
 
-            expect(response.statusCode).to.equal(202);
+            expect(response.status).to.equal(202);
 
             let data = await fs.promises.readFile(authorizedKeysFile, 'utf8');
             let count = (data.match(/support@cloudron.io/g) || []).length;
@@ -44,7 +44,7 @@ describe('Support API', function () {
         it('returns true when remote support enabled', async function () {
             const response = await superagent.get(`${serverUrl}/api/v1/support/remote_support`)
                 .query({ access_token: owner.token });
-            expect(response.statusCode).to.equal(200);
+            expect(response.status).to.equal(200);
             expect(response.body.enabled).to.be(true);
         });
 
@@ -52,7 +52,7 @@ describe('Support API', function () {
             const response = await superagent.post(`${serverUrl}/api/v1/support/remote_support`)
                 .query({ access_token: owner.token })
                 .send({ enabled: true });
-            expect(response.statusCode).to.equal(202);
+            expect(response.status).to.equal(202);
 
             let data = await fs.promises.readFile(authorizedKeysFile, 'utf8');
             let count = (data.match(/support@cloudron.io/g) || []).length;
@@ -64,7 +64,7 @@ describe('Support API', function () {
                 .query({ access_token: owner.token })
                 .send({ enabled: false });
 
-            expect(response.statusCode).to.equal(202);
+            expect(response.status).to.equal(202);
 
             let data = await fs.promises.readFile(authorizedKeysFile, 'utf8');
             let count = (data.match(/support@cloudron.io/g) || []).length;
@@ -76,7 +76,7 @@ describe('Support API', function () {
                 .query({ access_token: owner.token })
                 .send({ enabled: false });
 
-            expect(response.statusCode).to.equal(202);
+            expect(response.status).to.equal(202);
 
             const data = await fs.promises.readFile(authorizedKeysFile, 'utf8');
             const count = (data.match(/support@cloudron.io/g) || []).length;
@@ -90,7 +90,7 @@ describe('Support API', function () {
                 .send({ type: 'ticket', subject: 'some subject', description: 'some description' })
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(401);
+            expect(response.status).to.equal(401);
         });
 
         it('fails without type', async function () {
@@ -99,7 +99,7 @@ describe('Support API', function () {
                 .query({ access_token: owner.token })
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(400);
+            expect(response.status).to.equal(400);
         });
 
         it('fails with empty type', async function () {
@@ -108,7 +108,7 @@ describe('Support API', function () {
                 .query({ access_token: owner.token })
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(400);
+            expect(response.status).to.equal(400);
         });
 
         it('fails with unknown type', async function () {
@@ -117,7 +117,7 @@ describe('Support API', function () {
                 .query({ access_token: owner.token })
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(400);
+            expect(response.status).to.equal(400);
         });
 
         it('fails without description', async function () {
@@ -126,7 +126,7 @@ describe('Support API', function () {
                 .query({ access_token: owner.token })
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(400);
+            expect(response.status).to.equal(400);
         });
 
         it('fails with empty subject', async function () {
@@ -135,7 +135,7 @@ describe('Support API', function () {
                 .query({ access_token: owner.token })
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(400);
+            expect(response.status).to.equal(400);
         });
 
         it('fails with empty description', async function () {
@@ -144,7 +144,7 @@ describe('Support API', function () {
                 .query({ access_token: owner.token })
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(400);
+            expect(response.status).to.equal(400);
         });
 
         it('fails without subject', async function () {
@@ -153,7 +153,7 @@ describe('Support API', function () {
                 .query({ access_token: owner.token })
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(400);
+            expect(response.status).to.equal(400);
         });
 
         it('succeeds with ticket type', async function () {
@@ -166,7 +166,7 @@ describe('Support API', function () {
                 .send({ type: 'ticket', subject: 'some subject', description: 'some description' })
                 .query({ access_token: owner.token });
 
-            expect(response.statusCode).to.equal(201);
+            expect(response.status).to.equal(201);
             expect(scope2.isDone()).to.be.ok();
         });
 
@@ -176,7 +176,7 @@ describe('Support API', function () {
                 .query({ access_token: user.token })
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(403);
+            expect(response.status).to.equal(403);
         });
 
         it('admin also cannot open tickets', async function () {
@@ -185,7 +185,7 @@ describe('Support API', function () {
                 .query({ access_token: admin.token })
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(403);
+            expect(response.status).to.equal(403);
         });
 
         it('owner can open tickets', async function () {
@@ -198,7 +198,7 @@ describe('Support API', function () {
                 .send({ type: 'app_missing', subject: 'some subject', description: 'some description' })
                 .query({ access_token: owner.token });
 
-            expect(response.statusCode).to.equal(201);
+            expect(response.status).to.equal(201);
             expect(scope2.isDone()).to.be.ok();
         });
     });
diff --git a/src/routes/test/system-test.js b/src/routes/test/system-test.js
index abdf103b5..d38766f78 100644
--- a/src/routes/test/system-test.js
+++ b/src/routes/test/system-test.js
@@ -13,7 +13,7 @@ const constants = require('../../constants.js'),
     os = require('os'),
     paths = require('../../paths.js'),
     safe = require('safetydance'),
-    superagent = require('superagent');
+    superagent = require('../../superagent.js');
 
 describe('System', function () {
     const { setup, cleanup, serverUrl, owner, user, waitForTask } = common;
@@ -26,7 +26,7 @@ describe('System', function () {
             const response = await superagent.get(`${serverUrl}/api/v1/system/cpus`)
                 .query({ access_token: owner.token });
 
-            expect(response.statusCode).to.equal(200);
+            expect(response.status).to.equal(200);
             expect(response.body.cpus).to.be.ok();
 
             expect(response.body.cpus.every(c => typeof c.model === 'string')).to.be(true);
@@ -38,7 +38,7 @@ describe('System', function () {
             const response = await superagent.get(`${serverUrl}/api/v1/system/info`)
                 .query({ access_token: owner.token });
 
-            expect(response.statusCode).to.equal(200);
+            expect(response.status).to.equal(200);
             expect(response.body.info).to.be.ok();
 
             expect(response.body.info.sysVendor).to.be.a('string');
@@ -60,7 +60,7 @@ describe('System', function () {
                 .query({ access_token: owner.token, fromLine: 0 })
                 .ok(() => true);
 
-            expect(response.statusCode).to.be(400);
+            expect(response.status).to.be(400);
         });
 
         it('logStream - stream logs', function (done) {
@@ -106,14 +106,14 @@ describe('System', function () {
             const response = await superagent.get(`${serverUrl}/api/v1/system/memory`)
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(401);
+            expect(response.status).to.equal(401);
         });
 
         it('succeeds (admin)', async function () {
             const response = await superagent.get(`${serverUrl}/api/v1/system/memory`)
                 .query({ access_token: owner.token });
 
-            expect(response.statusCode).to.equal(200);
+            expect(response.status).to.equal(200);
             expect(response.body.memory).to.eql(os.totalmem());
             expect(response.body.swap).to.be.a('number');
         });
@@ -122,7 +122,7 @@ describe('System', function () {
             const response = await superagent.get(`${serverUrl}/api/v1/system/memory`)
                 .query({ access_token: user.token });
 
-            expect(response.statusCode).to.equal(200);
+            expect(response.status).to.equal(200);
             expect(response.body.memory).to.eql(os.totalmem());
             expect(response.body.swap).to.be.a('number');
         });
@@ -135,7 +135,7 @@ describe('System', function () {
             const response = await superagent.get(`${serverUrl}/api/v1/system/disk_usage`)
                 .query({ access_token: owner.token });
 
-            expect(response.statusCode).to.equal(200);
+            expect(response.status).to.equal(200);
             expect(response.body).to.eql({ usage: null });
         });
 
@@ -144,7 +144,7 @@ describe('System', function () {
                 .query({ access_token: owner.token })
                 .send({});
 
-            expect(response.statusCode).to.equal(201);
+            expect(response.status).to.equal(201);
             expect(response.body.taskId).to.be.ok();
             await waitForTask(response.body.taskId);
         });
@@ -153,7 +153,7 @@ describe('System', function () {
             const response = await superagent.get(`${serverUrl}/api/v1/system/disk_usage`)
                 .query({ access_token: owner.token });
 
-            expect(response.statusCode).to.equal(200);
+            expect(response.status).to.equal(200);
             expect(response.body.usage.ts).to.be.a('number');
 
             const filesystems = Object.keys(response.body.usage.filesystems);
@@ -173,7 +173,7 @@ describe('System', function () {
             const response = await superagent.get(`${serverUrl}/api/v1/system/block_devices`)
                 .query({ access_token: owner.token });
 
-            expect(response.statusCode).to.equal(200);
+            expect(response.status).to.equal(200);
             expect(response.body.devices).to.be.ok();
 
             expect(response.body.devices.some(d => d.mountpoint === '/')).to.be(true);
diff --git a/src/routes/test/tasks-test.js b/src/routes/test/tasks-test.js
index 0b944706c..4a3abf03c 100644
--- a/src/routes/test/tasks-test.js
+++ b/src/routes/test/tasks-test.js
@@ -7,7 +7,7 @@
 
 const common = require('./common.js'),
     expect = require('expect.js'),
-    superagent = require('superagent'),
+    superagent = require('../../superagent.js'),
     tasks = require('../../tasks.js');
 
 describe('Tasks API', function () {
@@ -24,7 +24,7 @@ describe('Tasks API', function () {
                 const response = await superagent.get(`${serverUrl}/api/v1/tasks/${taskId}`)
                     .query({ access_token: owner.token });
 
-                expect(response.statusCode).to.equal(200);
+                expect(response.status).to.equal(200);
                 expect(response.body.percent).to.be(100);
                 expect(response.body.args).to.be(undefined);
                 expect(response.body.active).to.be(false); // finished
@@ -44,7 +44,7 @@ describe('Tasks API', function () {
                 const response = await superagent.get(`${serverUrl}/api/v1/tasks/${taskId}/logs`)
                     .query({ access_token: owner.token });
 
-                expect(response.statusCode).to.equal(200);
+                expect(response.status).to.equal(200);
                 resolve();
             });
         });
@@ -59,7 +59,7 @@ describe('Tasks API', function () {
                     .query({ access_token: owner.token })
                     .ok(() => true);
 
-                expect(response.statusCode).to.equal(409);
+                expect(response.status).to.equal(409);
                 resolve();
             });
         });
@@ -74,7 +74,7 @@ describe('Tasks API', function () {
                 const response = await superagent.get(`${serverUrl}/api/v1/tasks/${taskId}`)
                     .query({ access_token: owner.token });
 
-                expect(response.statusCode).to.equal(200);
+                expect(response.status).to.equal(200);
                 expect(response.body.percent).to.be(100);
                 expect(response.body.active).to.be(false); // finished
                 expect(response.body.success).to.be(false);
@@ -87,7 +87,7 @@ describe('Tasks API', function () {
                 const response = await superagent.post(`${serverUrl}/api/v1/tasks/${taskId}/stop`)
                     .query({ access_token: owner.token });
 
-                expect(response.statusCode).to.equal(204);
+                expect(response.status).to.equal(204);
             }, 100);
         });
     });
@@ -100,7 +100,7 @@ describe('Tasks API', function () {
                 const response = await superagent.get(`${serverUrl}/api/v1/tasks?type=${tasks._TASK_IDENTITY}`)
                     .query({ access_token: owner.token });
 
-                expect(response.statusCode).to.equal(200);
+                expect(response.status).to.equal(200);
                 expect(response.body.tasks.length >= 1).to.be(true);
                 expect(response.body.tasks[0].id).to.be(taskId);
                 expect(response.body.tasks[0].percent).to.be(100);
diff --git a/src/routes/test/tokens-test.js b/src/routes/test/tokens-test.js
index f2a3e62a2..fdd3b03c2 100644
--- a/src/routes/test/tokens-test.js
+++ b/src/routes/test/tokens-test.js
@@ -7,7 +7,7 @@
 
 const common = require('./common.js'),
     expect = require('expect.js'),
-    superagent = require('superagent');
+    superagent = require('../../superagent.js');
 
 describe('Tokens API', function () {
     const { setup, cleanup, serverUrl, owner } = common;
@@ -23,7 +23,7 @@ describe('Tokens API', function () {
                 .query({ access_token: owner.token })
                 .send({ name: new Array(128).fill('s').join('') })
                 .ok(() => true);
-            expect(response.statusCode).to.equal(400);
+            expect(response.status).to.equal(400);
         });
 
         it('can create token', async function () {
@@ -58,7 +58,7 @@ describe('Tokens API', function () {
         it('can list tokens', async function () {
             const response = await superagent.get(`${serverUrl}/api/v1/tokens`)
                 .query({ access_token: owner.token });
-            expect(response.statusCode).to.equal(200);
+            expect(response.status).to.equal(200);
             expect(response.body.tokens.length).to.be(3); // one is owner token on activation
             const tokenIds = response.body.tokens.map(t => t.id);
             expect(tokenIds).to.contain(token.id);
@@ -68,14 +68,14 @@ describe('Tokens API', function () {
         it('can get token', async function () {
             const response = await superagent.get(`${serverUrl}/api/v1/tokens/${token.id}`)
                 .query({ access_token: owner.token });
-            expect(response.statusCode).to.equal(200);
+            expect(response.status).to.equal(200);
             expect(response.body.id).to.be(token.id);
         });
 
         it('can delete token', async function () {
             const response = await superagent.del(`${serverUrl}/api/v1/tokens/${token.id}`)
                 .query({ access_token: owner.token });
-            expect(response.statusCode).to.equal(204);
+            expect(response.status).to.equal(204);
         });
     });
 
@@ -114,14 +114,14 @@ describe('Tokens API', function () {
                 .send(DOMAIN_0)
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(403);
+            expect(response.status).to.equal(403);
         });
 
         it('cannot get non-existent token', async function () {
             const response = await superagent.get(`${serverUrl}/api/v1/tokens/foobar`)
                 .query({ access_token: owner.token })
                 .ok(() => true);
-            expect(response.statusCode).to.equal(404);
+            expect(response.status).to.equal(404);
         });
     });
 });
diff --git a/src/routes/test/updater-test.js b/src/routes/test/updater-test.js
index 26080a990..a0613975f 100644
--- a/src/routes/test/updater-test.js
+++ b/src/routes/test/updater-test.js
@@ -8,7 +8,7 @@
 const common = require('./common.js'),
     constants = require('../../constants.js'),
     expect = require('expect.js'),
-    superagent = require('superagent');
+    superagent = require('../../superagent.js');
 
 describe('Updater API', function () {
     const { setup, cleanup, serverUrl, owner } = common;
@@ -20,7 +20,7 @@ describe('Updater API', function () {
         it('can get app auto update pattern (default)', async function () {
             const response = await superagent.get(`${serverUrl}/api/v1/updater/autoupdate_pattern`)
                 .query({ access_token: owner.token });
-            expect(response.statusCode).to.equal(200);
+            expect(response.status).to.equal(200);
             expect(response.body.pattern).to.be.ok();
         });
 
@@ -28,20 +28,20 @@ describe('Updater API', function () {
             const response = await superagent.post(`${serverUrl}/api/v1/updater/autoupdate_pattern`)
                 .query({ access_token: owner.token })
                 .ok(() => true);
-            expect(response.statusCode).to.equal(400);
+            expect(response.status).to.equal(400);
         });
 
         it('can set autoupdate_pattern', async function () {
             const response = await superagent.post(`${serverUrl}/api/v1/updater/autoupdate_pattern`)
                 .query({ access_token: owner.token })
                 .send({ pattern: '00 30 11 * * 1-5' });
-            expect(response.statusCode).to.equal(200);
+            expect(response.status).to.equal(200);
         });
 
         it('can get auto update pattern', async function () {
             const response = await superagent.get(`${serverUrl}/api/v1/updater/autoupdate_pattern`)
                 .query({ access_token: owner.token });
-            expect(response.statusCode).to.equal(200);
+            expect(response.status).to.equal(200);
             expect(response.body.pattern).to.be('00 30 11 * * 1-5');
         });
 
@@ -49,13 +49,13 @@ describe('Updater API', function () {
             const response = await superagent.post(`${serverUrl}/api/v1/updater/autoupdate_pattern`)
                 .query({ access_token: owner.token })
                 .send({ pattern: constants.AUTOUPDATE_PATTERN_NEVER });
-            expect(response.statusCode).to.equal(200);
+            expect(response.status).to.equal(200);
         });
 
         it('can get auto update pattern', async function () {
             const response = await superagent.get(`${serverUrl}/api/v1/updater/autoupdate_pattern`)
                 .query({ access_token: owner.token });
-            expect(response.statusCode).to.equal(200);
+            expect(response.status).to.equal(200);
             expect(response.body.pattern).to.be(constants.AUTOUPDATE_PATTERN_NEVER);
         });
 
@@ -64,7 +64,7 @@ describe('Updater API', function () {
                 .query({ access_token: owner.token })
                 .send({ pattern: '1 3 x 5 6' })
                 .ok(() => true);
-            expect(response.statusCode).to.equal(400);
+            expect(response.status).to.equal(400);
         });
     });
 });
diff --git a/src/routes/test/user-directory-test.js b/src/routes/test/user-directory-test.js
index 5be31d151..580f96592 100644
--- a/src/routes/test/user-directory-test.js
+++ b/src/routes/test/user-directory-test.js
@@ -8,7 +8,7 @@
 
 const common = require('./common.js'),
     expect = require('expect.js'),
-    superagent = require('superagent');
+    superagent = require('../../superagent.js');
 
 describe('User Directory API', function () {
     const { setup, cleanup, serverUrl, owner, user } = common;
@@ -22,7 +22,7 @@ describe('User Directory API', function () {
                 .query({ access_token: owner.token })
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(200);
+            expect(response.status).to.equal(200);
             expect(response.body.lockUserProfiles).to.be(false);
             expect(response.body.mandatory2FA).to.be(false);
         });
@@ -33,7 +33,7 @@ describe('User Directory API', function () {
                 .send({ lockUserProfiles: true })
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(400);
+            expect(response.status).to.equal(400);
         });
 
         it('cannot set as normal user', async function() {
@@ -42,7 +42,7 @@ describe('User Directory API', function () {
                 .send({ lockUserProfiles: true, mandatory2FA: true })
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(403);
+            expect(response.status).to.equal(403);
         });
 
         it('can lock user profile', async function() {
@@ -51,14 +51,14 @@ describe('User Directory API', function () {
                 .send({ lockUserProfiles: true, mandatory2FA: false })
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(200);
+            expect(response.status).to.equal(200);
 
             const response2 = await superagent.post(`${serverUrl}/api/v1/profile/email`)
                 .query({ access_token: owner.token })
                 .send({ email: 'newemail@example.Com', password: owner.password })
                 .ok(() => true);
 
-            expect(response2.statusCode).to.equal(403); // profile is locked
+            expect(response2.status).to.equal(403); // profile is locked
         });
 
         it('can set mandatory 2fa', async function() {
@@ -67,20 +67,20 @@ describe('User Directory API', function () {
                 .send({ lockUserProfiles: true, mandatory2FA: true })
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(200);
+            expect(response.status).to.equal(200);
 
             // token gets revoked!
             const response2 = await superagent.get(`${serverUrl}/api/v1/profile`)
                 .query({ access_token: owner.token })
                 .ok(() => true);
 
-            expect(response2.statusCode).to.equal(200); // token is not gone, since it is persisted
+            expect(response2.status).to.equal(200); // token is not gone, since it is persisted
 
             const response3 = await superagent.get(`${serverUrl}/api/v1/profile`)
                 .query({ access_token: user.token })
                 .ok(() => true);
 
-            expect(response3.statusCode).to.equal(401); // token is gone
+            expect(response3.status).to.equal(401); // token is gone
         });
     });
 });
diff --git a/src/routes/test/users-test.js b/src/routes/test/users-test.js
index c1a472d7f..fc8f9101a 100644
--- a/src/routes/test/users-test.js
+++ b/src/routes/test/users-test.js
@@ -7,7 +7,7 @@
 
 const common = require('./common.js'),
     expect = require('expect.js'),
-    superagent = require('superagent'),
+    superagent = require('../../superagent.js'),
     users = require('../../users.js');
 
 describe('Users API', function () {
@@ -50,14 +50,14 @@ describe('Users API', function () {
                 .query({ access_token: owner.token })
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(404);
+            expect(response.status).to.equal(404);
         });
 
         it('can get userInfo with token', async function () {
             const response = await superagent.get(`${serverUrl}/api/v1/users/${user.id}`)
                 .query({ access_token: owner.token });
 
-            expect(response.statusCode).to.equal(200);
+            expect(response.status).to.equal(200);
             expect(response.body.username).to.equal(user.username.toLowerCase());
             expect(response.body.email).to.equal(user.email.toLowerCase());
             expect(response.body.groupIds).to.eql([]);
@@ -69,7 +69,7 @@ describe('Users API', function () {
                 .query({ access_token: user.token })
                 .ok(() => true);
 
-            expect(reponse.statusCode).to.equal(403);
+            expect(reponse.status).to.equal(403);
         });
     });
 
@@ -80,7 +80,7 @@ describe('Users API', function () {
                 .send({ username: user2.username })
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(400);
+            expect(response.status).to.equal(400);
         });
 
         it('cannot create user with non email fallbackEmail', async function () {
@@ -89,7 +89,7 @@ describe('Users API', function () {
                 .send({ username: user2.username, email: user2.email, fallbackEmail: 'notanemail' })
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(400);
+            expect(response.status).to.equal(400);
         });
 
         it('create second user succeeds', async function () {
@@ -97,7 +97,7 @@ describe('Users API', function () {
                 .query({ access_token: owner.token })
                 .send({ username: user2.username, email: user2.email });
 
-            expect(response.statusCode).to.equal(201);
+            expect(response.status).to.equal(201);
 
             user2.id = response.body.id;
         });
@@ -106,7 +106,7 @@ describe('Users API', function () {
             const response = await superagent.get(`${serverUrl}/api/v1/users/${user2.id}`)
                 .query({ access_token: owner.token });
 
-            expect(response.statusCode).to.equal(200);
+            expect(response.status).to.equal(200);
             expect(response.body.username).to.equal(user2.username.toLowerCase());
             expect(response.body.email).to.equal(user2.email.toLowerCase());
             expect(response.body.groupIds).to.eql([]);
@@ -117,7 +117,7 @@ describe('Users API', function () {
                 .query({ access_token: owner.token })
                 .send({ email: unnamedUser.email });
 
-            expect(response.statusCode).to.equal(201);
+            expect(response.status).to.equal(201);
             unnamedUser.id = response.body.id;
         });
 
@@ -127,7 +127,7 @@ describe('Users API', function () {
                 .send({ username: 'someusername' })
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(400);
+            expect(response.status).to.equal(400);
         });
 
         it('create user reserved name fails', async function () {
@@ -136,7 +136,7 @@ describe('Users API', function () {
                 .send({ username: 'no-reply', email: 'reserved@cloudron.local' })
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(400);
+            expect(response.status).to.equal(400);
         });
 
         it('create user with short name succeeds', async function () {
@@ -144,7 +144,7 @@ describe('Users API', function () {
                 .query({ access_token: owner.token })
                 .send({ username: 'n', email: 'singleletter@cloudron.local' });
 
-            expect(response.statusCode).to.equal(201);
+            expect(response.status).to.equal(201);
         });
 
         it('create user with same username should fail', async function () {
@@ -153,7 +153,7 @@ describe('Users API', function () {
                 .send({ username: user2.username, email: user2.email })
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(409);
+            expect(response.status).to.equal(409);
         });
 
         it('cannot create user with bad password', async function () {
@@ -162,7 +162,7 @@ describe('Users API', function () {
                 .send({ username: 'badpassworduser', email: 'badpass@cloudron.local', password:'tooweak' })
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(400);
+            expect(response.status).to.equal(400);
         });
 
         it('can create user with a password', async function () {
@@ -170,7 +170,7 @@ describe('Users API', function () {
                 .query({ access_token: owner.token })
                 .send({ username: userWithPassword.username, email: userWithPassword.email, password: userWithPassword.password });
 
-            expect(response.statusCode).to.equal(201);
+            expect(response.status).to.equal(201);
             userWithPassword.id = response.body.id;
         });
 
@@ -185,7 +185,7 @@ describe('Users API', function () {
                 .query({ access_token: owner.token })
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(404);
+            expect(response.status).to.equal(404);
         });
 
         it('creation succeeds', async function () {
@@ -193,7 +193,7 @@ describe('Users API', function () {
                 .query({ access_token: owner.token })
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(200);
+            expect(response.status).to.equal(200);
             expect(response.body.inviteLink).to.be.a('string');
         });
 
@@ -204,7 +204,7 @@ describe('Users API', function () {
                 .query({ access_token: owner.token })
                 .send({ email: user.email });
 
-            expect(response.statusCode).to.equal(202);
+            expect(response.status).to.equal(202);
             await common.checkMails(1);
         });
     });
@@ -215,14 +215,14 @@ describe('Users API', function () {
                 .query({ access_token: owner.token })
                 .send({ role: users.ROLE_ADMIN });
 
-            expect(response.statusCode).to.equal(204);
+            expect(response.status).to.equal(204);
         });
 
         it('did set second user as admin', async function () {
             const response = await superagent.get(`${serverUrl}/api/v1/users/${user.id}`)
                 .query({ access_token: owner.token });
 
-            expect(response.statusCode).to.equal(200);
+            expect(response.status).to.equal(200);
             expect(response.body.role).to.be(users.ROLE_ADMIN);
         });
 
@@ -232,7 +232,7 @@ describe('Users API', function () {
                 .send({ role: users.ROLE_ADMIN })
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(409);
+            expect(response.status).to.equal(409);
         });
 
         it('make self as normal user fails', async function () {
@@ -241,7 +241,7 @@ describe('Users API', function () {
                 .send({ role: users.ROLE_USER })
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(409);
+            expect(response.status).to.equal(409);
         });
 
         it('remove second user as admin succeeds', async function () {
@@ -249,7 +249,7 @@ describe('Users API', function () {
                 .query({ access_token: owner.token })
                 .send({ role: users.ROLE_USER });
 
-            expect(response.statusCode).to.equal(204);
+            expect(response.status).to.equal(204);
         });
 
         it('normal user cannot change role of admin', async function () {
@@ -258,7 +258,7 @@ describe('Users API', function () {
                 .send({ role: users.ROLE_USER })
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(403);
+            expect(response.status).to.equal(403);
         });
     });
 
@@ -267,7 +267,7 @@ describe('Users API', function () {
             const response = await superagent.get(`${serverUrl}/api/v1/users`)
                 .query({ access_token: owner.token });
 
-            expect(response.statusCode).to.equal(200);
+            expect(response.status).to.equal(200);
             expect(response.body.users).to.be.an('array');
 
             response.body.users.forEach(function (user) {
@@ -282,14 +282,14 @@ describe('Users API', function () {
                 .query({ access_token: user.token })
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(403);
+            expect(response.status).to.equal(403);
         });
 
         it('list users succeeds for admin', async function () {
             const response = await superagent.get(`${serverUrl}/api/v1/users`)
                 .query({ access_token: owner.token });
 
-            expect(response.statusCode).to.equal(200);
+            expect(response.status).to.equal(200);
             expect(response.body.users).to.be.an('array');
             expect(response.body.users.length).to.be.greaterThan(3);
 
@@ -311,7 +311,7 @@ describe('Users API', function () {
                 .send({ email: 'newemail@cloudron.local' })
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(401);
+            expect(response.status).to.equal(401);
         });
 
         it('change email fails due to invalid email', async function () {
@@ -320,7 +320,7 @@ describe('Users API', function () {
                 .send({ email: 'newemail@cloudron' })
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(400);
+            expect(response.status).to.equal(400);
         });
 
         it('change fallbackEmail fails due to invalid email', async function () {
@@ -329,7 +329,7 @@ describe('Users API', function () {
                 .send({ fallbackEmail: 'newemail@cloudron' })
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(400);
+            expect(response.status).to.equal(400);
         });
 
         it('change user succeeds without email nor displayName', async function () {
@@ -337,7 +337,7 @@ describe('Users API', function () {
                 .query({ access_token: owner.token })
                 .send({});
 
-            expect(response.statusCode).to.equal(204);
+            expect(response.status).to.equal(204);
         });
 
         it('change email succeeds', async function () {
@@ -346,12 +346,12 @@ describe('Users API', function () {
                 .query({ access_token: owner.token })
                 .send({ email: user2.email });
 
-            expect(response.statusCode).to.equal(204);
+            expect(response.status).to.equal(204);
 
             const response2 = await superagent.get(`${serverUrl}/api/v1/users/${user2.id}`)
                 .query({ access_token: owner.token });
 
-            expect(response2.statusCode).to.equal(200);
+            expect(response2.status).to.equal(200);
             expect(response2.body.username).to.equal(user2.username.toLowerCase());
             expect(response2.body.email).to.equal(user2.email.toLowerCase());
             expect(response2.body.displayName).to.equal('');
@@ -363,7 +363,7 @@ describe('Users API', function () {
                 .send({ email: owner.email })
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(409);
+            expect(response.status).to.equal(409);
         });
 
         it('can change display name', async function () {
@@ -373,12 +373,12 @@ describe('Users API', function () {
                 .query({ access_token: owner.token })
                 .send({ displayName: displayName });
 
-            expect(response.statusCode).to.equal(204);
+            expect(response.status).to.equal(204);
 
             const response2 = await superagent.get(`${serverUrl}/api/v1/users/${user2.id}`)
                 .query({ access_token: owner.token });
 
-            expect(response2.statusCode).to.equal(200);
+            expect(response2.status).to.equal(200);
             expect(response2.body.displayName).to.equal(displayName);
         });
     });
@@ -389,7 +389,7 @@ describe('Users API', function () {
                 .send({ password: 'youdontsay' })
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(401);
+            expect(response.status).to.equal(401);
         });
 
         it('change password fails due to small password', async function () {
@@ -398,7 +398,7 @@ describe('Users API', function () {
                 .send({ password: 'small' })
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(400);
+            expect(response.status).to.equal(400);
         });
 
         it('change password succeeds', async function () {
@@ -406,7 +406,7 @@ describe('Users API', function () {
                 .query({ access_token: owner.token })
                 .send({ password: 'bigenough' });
 
-            expect(response.statusCode).to.equal(204);
+            expect(response.status).to.equal(204);
         });
 
         it('did change the user password', async function () {
@@ -420,12 +420,12 @@ describe('Users API', function () {
                 .query({ access_token: owner.token })
                 .send({ active: false });
 
-            expect(response.statusCode).to.equal(204);
+            expect(response.status).to.equal(204);
 
             const response2 = await superagent.get(`${serverUrl}/api/v1/users/${user.id}`)
                 .query({ access_token: owner.token });
 
-            expect(response2.statusCode).to.equal(200);
+            expect(response2.status).to.equal(200);
             expect(response2.body.active).to.equal(false);
         });
 
@@ -434,12 +434,12 @@ describe('Users API', function () {
                 .query({ access_token: owner.token })
                 .send({ active: true });
 
-            expect(response.statusCode).to.equal(204);
+            expect(response.status).to.equal(204);
 
             const response2 = await superagent.get(`${serverUrl}/api/v1/users/${user.id}`)
                 .query({ access_token: owner.token });
 
-            expect(response2.statusCode).to.equal(200);
+            expect(response2.status).to.equal(200);
             expect(response2.body.active).to.equal(true);
         });
     });
@@ -450,14 +450,14 @@ describe('Users API', function () {
                 .query({ access_token: owner.token })
                 .send({ role: users.ROLE_USER_MANAGER });
 
-            expect(response.statusCode).to.equal(204);
+            expect(response.status).to.equal(204);
         });
 
         it('can list users as usermanager', async function () {
             const response = await superagent.get(`${serverUrl}/api/v1/users`)
                 .query({ access_token: user.token });
 
-            expect(response.statusCode).to.equal(200);
+            expect(response.status).to.equal(200);
             expect(response.body.users).to.be.an(Array);
             expect(response.body.users.length).to.be.greaterThan(3);
         });
@@ -468,7 +468,7 @@ describe('Users API', function () {
                 .send({ password: 'bigenough' })
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(403);
+            expect(response.status).to.equal(403);
         });
 
         it('can set password of another', async function () {
@@ -476,7 +476,7 @@ describe('Users API', function () {
                 .query({ access_token: user.token })
                 .send({ password: 'bigenough' });
 
-            expect(response.statusCode).to.equal(204);
+            expect(response.status).to.equal(204);
         });
 
         it('cannot change admin bit of another', async function () {
@@ -485,7 +485,7 @@ describe('Users API', function () {
                 .send({ role: users.ROLE_ADMIN })
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(403);
+            expect(response.status).to.equal(403);
         });
 
         it('cannot change admin bit of self', async function () {
@@ -494,7 +494,7 @@ describe('Users API', function () {
                 .send({ role: users.ROLE_ADMIN })
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(409);
+            expect(response.status).to.equal(409);
         });
 
         it('cannot remove admin', async function () {
@@ -502,7 +502,7 @@ describe('Users API', function () {
                 .query({ access_token: user.token })
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(403);
+            expect(response.status).to.equal(403);
         });
 
         it('can create user as user manager', async function () {
@@ -510,7 +510,7 @@ describe('Users API', function () {
                 .query({ access_token: user.token })
                 .send({ username: user3.username, email: user3.email });
 
-            expect(response.statusCode).to.equal(201);
+            expect(response.status).to.equal(201);
 
             user3.id = response.body.id;
         });
@@ -519,7 +519,7 @@ describe('Users API', function () {
             const response = await superagent.del(`${serverUrl}/api/v1/users/${user3.id}`)
                 .query({ access_token: user.token });
 
-            expect(response.statusCode).to.equal(204);
+            expect(response.status).to.equal(204);
         });
 
         it('add mailbox fails', async function () {
@@ -528,7 +528,7 @@ describe('Users API', function () {
                 .query({ access_token: user.token })
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(403);
+            expect(response.status).to.equal(403);
         });
     });
 
@@ -538,14 +538,14 @@ describe('Users API', function () {
                 .query({ access_token: owner.token })
                 .send({ role: users.ROLE_MAIL_MANAGER });
 
-            expect(response.statusCode).to.equal(204);
+            expect(response.status).to.equal(204);
         });
 
         it('can list users as mail manager', async function () {
             const response = await superagent.get(`${serverUrl}/api/v1/users`)
                 .query({ access_token: user.token });
 
-            expect(response.statusCode).to.equal(200);
+            expect(response.status).to.equal(200);
             expect(response.body.users).to.be.an(Array);
             expect(response.body.users.length).to.be.greaterThan(3);
         });
@@ -556,7 +556,7 @@ describe('Users API', function () {
                 .send({ role: users.ROLE_ADMIN })
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(409);
+            expect(response.status).to.equal(409);
         });
 
         it('cannot remove admin', async function () {
@@ -564,7 +564,7 @@ describe('Users API', function () {
                 .query({ access_token: user.token })
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(403);
+            expect(response.status).to.equal(403);
         });
 
         it('can create user as mail manager', async function () {
@@ -572,7 +572,7 @@ describe('Users API', function () {
                 .query({ access_token: user.token })
                 .send({ username: user3.username, email: user3.email });
 
-            expect(response.statusCode).to.equal(201);
+            expect(response.status).to.equal(201);
 
             user3.id = response.body.id;
         });
@@ -581,7 +581,7 @@ describe('Users API', function () {
             const response = await superagent.del(`${serverUrl}/api/v1/users/${user3.id}`)
                 .query({ access_token: user.token });
 
-            expect(response.statusCode).to.equal(204);
+            expect(response.status).to.equal(204);
         });
 
         it('add mailbox succeeds as mail manager', async function () {
@@ -589,14 +589,14 @@ describe('Users API', function () {
                 .send({ name: 'support', ownerId: owner.id, ownerType: 'user', active: true, storageQuota: 0, messagesQuota: 0 })
                 .query({ access_token: user.token });
 
-            expect(response.statusCode).to.equal(201);
+            expect(response.status).to.equal(201);
         });
 
         it('list mailbox succeeds as mail manager', async function () {
             const response = await superagent.get(`${serverUrl}/api/v1/mail/${dashboardDomain}/mailboxes`)
                 .query({ access_token: user.token });
 
-            expect(response.statusCode).to.equal(200);
+            expect(response.status).to.equal(200);
             expect(response.body.mailboxes.length).to.be(1);
             expect(response.body.mailboxes[0].name).to.be('support');
         });
@@ -608,7 +608,7 @@ describe('Users API', function () {
                 .query({ access_token: owner.token })
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(404);
+            expect(response.status).to.equal(404);
         });
 
         it('user cannot removes himself', async function () {
@@ -616,7 +616,7 @@ describe('Users API', function () {
                 .query({ access_token: owner.token })
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(409);
+            expect(response.status).to.equal(409);
         });
 
         it('admin removes normal user', async function () {
@@ -624,7 +624,7 @@ describe('Users API', function () {
                 .query({ access_token: owner.token })
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(204);
+            expect(response.status).to.equal(204);
         });
 
         it('admin removes himself should not be allowed', async function () {
@@ -632,7 +632,7 @@ describe('Users API', function () {
                 .query({ access_token: owner.token })
                 .ok(() => true);
 
-            expect(response.statusCode).to.equal(409);
+            expect(response.status).to.equal(409);
         });
     });
 });
diff --git a/src/routes/test/volumes-test.js b/src/routes/test/volumes-test.js
index ca5e584d3..bb41d0297 100644
--- a/src/routes/test/volumes-test.js
+++ b/src/routes/test/volumes-test.js
@@ -8,7 +8,7 @@
 const common = require('./common.js'),
     expect = require('expect.js'),
     safe = require('safetydance'),
-    superagent = require('superagent');
+    superagent = require('../../superagent.js');
 
 describe('Volumes API', function () {
     const { setup, cleanup, serverUrl, owner } = common;
@@ -22,7 +22,7 @@ describe('Volumes API', function () {
             .query({ access_token: owner.token })
             .send({ name: 'music#/ ', mountType: 'filesystem', mountOptions: { hostPath: '/media/cloudron-test-music' } })
             .ok(() => true);
-        expect(response.statusCode).to.equal(400);
+        expect(response.status).to.equal(400);
     });
 
     it('cannot create volume with bad path', async function () {
@@ -30,7 +30,7 @@ describe('Volumes API', function () {
             .query({ access_token: owner.token })
             .send({ name: 'music', mountType: 'filesystem', mountOptions: { hostPath: '/tmp/music' } })
             .ok(() => true);
-        expect(response.statusCode).to.equal(400);
+        expect(response.status).to.equal(400);
     });
 
     it('can create volume', async function () {
@@ -47,7 +47,7 @@ describe('Volumes API', function () {
     it('can list volumes', async function () {
         const response = await superagent.get(`${serverUrl}/api/v1/volumes`)
             .query({ access_token: owner.token });
-        expect(response.statusCode).to.equal(200);
+        expect(response.status).to.equal(200);
         expect(response.body.volumes.length).to.be(1);
         expect(response.body.volumes[0].id).to.be(volumeId);
         expect(response.body.volumes[0].hostPath).to.be('/media/cloudron-test-music');
@@ -57,13 +57,13 @@ describe('Volumes API', function () {
         const response = await superagent.get(`${serverUrl}/api/v1/volumes/foobar`)
             .query({ access_token: owner.token })
             .ok(() => true);
-        expect(response.statusCode).to.equal(404);
+        expect(response.status).to.equal(404);
     });
 
     it('can get volume', async function () {
         const response = await superagent.get(`${serverUrl}/api/v1/volumes/${volumeId}`)
             .query({ access_token: owner.token });
-        expect(response.statusCode).to.equal(200);
+        expect(response.status).to.equal(200);
         expect(response.body.id).to.be(volumeId);
         expect(response.body.hostPath).to.be('/media/cloudron-test-music');
     });
@@ -74,12 +74,12 @@ describe('Volumes API', function () {
             .send({ mountOptions: { hostPath: '/media/cloudron-test-music-2' }})
             .ok(() => true));
 
-        expect(response.statusCode).to.equal(400); // cannot update filesytem
+        expect(response.status).to.equal(400); // cannot update filesytem
     });
 
     it('can delete volume', async function () {
         const response = await superagent.del(`${serverUrl}/api/v1/volumes/${volumeId}`)
             .query({ access_token: owner.token });
-        expect(response.statusCode).to.equal(204);
+        expect(response.status).to.equal(204);
     });
 });
diff --git a/src/services.js b/src/services.js
index 6b1069acc..073112c7e 100644
--- a/src/services.js
+++ b/src/services.js
@@ -68,7 +68,7 @@ const addonConfigs = require('./addonconfigs.js'),
     settings = require('./settings.js'),
     sftp = require('./sftp.js'),
     shell = require('./shell.js')('services'),
-    superagent = require('superagent');
+    superagent = require('./superagent.js');
 
 const NOOP = async function (/*app, options*/) {};
 const RMADDONDIR_CMD = path.join(__dirname, 'scripts/rmaddondir.sh');
@@ -334,7 +334,7 @@ async function containerStatus(containerName, tokenEnvName) {
         .ok(() => true));
 
     if (networkError) return { status: exports.SERVICE_STATUS_STARTING, error: `Error waiting for ${containerName}: ${networkError.message}` };
-    if (response.status !== 200 || !response.body.status) return { status: exports.SERVICE_STATUS_STARTING, error: `Error waiting for ${containerName}. Status code: ${response.statusCode} message: ${response.body.message}` };
+    if (response.status !== 200 || !response.body.status) return { status: exports.SERVICE_STATUS_STARTING, error: `Error waiting for ${containerName}. Status code: ${response.status} message: ${response.body.message}` };
 
     const result = await docker.memoryUsage(containerName);
     const stats = result.memory_stats || { usage: 0, limit: 1 };
diff --git a/src/superagent.js b/src/superagent.js
new file mode 100644
index 000000000..f9e65a1ba
--- /dev/null
+++ b/src/superagent.js
@@ -0,0 +1,163 @@
+'use strict';
+
+exports = module.exports = {
+    get,
+    put,
+    post,
+    patch,
+    del,
+    options,
+    request
+};
+
+// IMPORTANT: do not require box code here . This is used by migration scripts
+const { Agent } = require('undici'),
+    assert = require('assert'),
+    debug = require('debug')('box:superagent'),
+    fs = require('fs'),
+    path = require('path'),
+    safe = require('safetydance');
+
+class Request {
+    constructor(method, url) {
+        assert.strictEqual(typeof url, 'string');
+
+        this.url = new URL(url);
+        this.fetchOptions = {
+            method,
+            headers: new Headers(),
+            redirect: 'follow'
+        };
+        this.okFunc = (response) => response.ok;
+        this.timer = { timeout: 0, id: null, controller: null };
+        this.retryCount = 0;
+        this.fetchOptions.headers.set('Content-Type', 'application/json');
+    }
+
+    async _makeRequest() {
+        debug(`${this.fetchOptions.method} ${this.url.toString()}`);
+        const response = await fetch(this.url.toString(), this.fetchOptions); // will only throw with network error or bad scheme
+        const result = {
+            url: response.url, // can be different from original when response.redirected
+            status: response.status,
+            headers: Object.fromEntries(response.headers.entries()),
+            body: null,
+            text: null
+        };
+
+        const contentType = response.headers.get('Content-Type');
+        const data = await response.arrayBuffer();
+
+        if (contentType?.includes('application/json')) {
+            result.text = Buffer.from(data).toString('utf8');
+            if (data.byteLength !== 0) result.body = JSON.parse(result.text);
+        } else if (contentType?.includes('application/x-www-form-urlencoded')) {
+            result.text = Buffer.from(data).toString('utf8');
+            const searchParams = new URLSearchParams(data);
+            result.body = Object.fromEntries(searchParams.entries());
+        } else if (!contentType) {
+            result.body = Buffer.from(data);
+            result.text = result.body.toString('utf8');
+        } else {
+            result.body = Buffer.from(data);
+            result.text = `<binary data (${data.byteLength} bytes)>`;
+        }
+
+        if (!this.okFunc(response)) {
+			const error = new Error(`${response.status} ${response.statusText}`);
+            Object.assign(error, result);
+            throw error;
+        }
+
+        return result;
+    }
+
+    async _start() {
+        let error, response;
+        for (let i = 0; i < this.retryCount+1; i++) {
+            if (this.timer.timeout) this.timer.id = setTimeout(() => this.timer.controller.abort(), this.timer.timeout);
+            [error, response] = await safe(this._makeRequest());
+            if (this.timer.timeout) clearTimeout(this.timer.id);
+            if (!error) return response;
+        }
+
+        throw error;
+    }
+
+    set(name, value) {
+        this.fetchOptions.headers.set(name, value);
+        return this;
+    }
+
+    query(data) {
+        Object.entries(data).forEach(([key, value]) => this.url.searchParams.append(key, value));
+        return this;
+    }
+
+    redirects(count) {
+        this.fetchOptions.redirect = count ? 'follow' : 'error';
+        return this;
+    }
+
+    send(data) {
+        const contentType = this.fetchOptions.headers.get('Content-Type');
+        if (contentType === 'application/json') {
+            this.fetchOptions.headers.set('Content-Type', 'application/json');
+            this.fetchOptions.body = JSON.stringify(data);
+        } else if (contentType === 'application/x-www-form-urlencoded') {
+            this.fetchOptions.body = new URLSearchParams(data);
+        }
+        return this;
+    }
+
+    timeout(msecs) {
+        this.timer.controller = new AbortController();
+        this.timer.timeout = msecs;
+        this.fetchOptions.signal = this.timer.controller.signal;
+        return this;
+    }
+
+    retry(count) {
+        this.retryCount = Math.max(0, count);
+        return this;
+    }
+
+    ok(func) {
+        this.okFunc = func;
+        return this;
+    }
+
+    disableTLSCerts() {
+        this.fetchOptions.dispatcher = new Agent({
+            connect: {
+                rejectUnauthorized: false,
+            },
+        });
+        return this;
+    }
+
+    auth(username, password) {
+        this.set('Authorization', 'Basic ' + btoa(`${username}:${password}`));
+        return this;
+    }
+
+    attach(name, filepath) {
+        if (!(this.fetchOptions.body instanceof FormData)) this.fetchOptions.body = new FormData();
+        const data = fs.readFileSync(filepath, 'utf8');
+        this.fetchOptions.body.append(name, new Blob([data]), path.basename(filepath));
+        this.fetchOptions.headers.set('Content-Type', 'multipart/form-data');
+        return this;
+    }
+
+    then(onFulfilled, onRejected) {
+        this._start().then(onFulfilled, onRejected);
+    }
+}
+
+function get(url) { return new Request('GET', url); }
+function put(url) { return new Request('PUT', url); }
+function post(url) { return new Request('POST', url); }
+function patch(url) { return new Request('PATCH', url); }
+function del(url) { return new Request('DELETE', url); }
+function options(url) { return new Request('OPTIONS', url); }
+function request(method, url) { return new Request(method, url); }
diff --git a/src/test/server-test.js b/src/test/server-test.js
index d94a18886..eda954b74 100644
--- a/src/test/server-test.js
+++ b/src/test/server-test.js
@@ -10,7 +10,7 @@ const constants = require('../constants.js'),
     expect = require('expect.js'),
     safe = require('safetydance'),
     server = require('../server.js'),
-    superagent = require('superagent');
+    superagent = require('../superagent.js');
 
 const SERVER_URL = 'http://localhost:' + constants.PORT;
 
@@ -53,7 +53,7 @@ describe('Server', function () {
             expect(response.status).to.equal(404);
 
             const response2 = await superagent.get(SERVER_URL + '/api/v1/cloudron/status');
-            expect(response2.statusCode).to.equal(200);
+            expect(response2.status).to.equal(200);
         });
     });
 
@@ -63,7 +63,7 @@ describe('Server', function () {
 
         it('config fails due missing token', async function () {
             const response = await superagent.get(SERVER_URL + '/api/v1/dashboard/config').ok(() => true);
-            expect(response.statusCode).to.equal(401);
+            expect(response.status).to.equal(401);
         });
 
         it('config fails due wrong token', async function () {
@@ -86,7 +86,7 @@ describe('Server', function () {
         after(server.stop);
 
         it('responds to OPTIONS', async function () {
-            const response = await superagent('OPTIONS', SERVER_URL + '/api/v1/cloudron/status')
+            const response = await superagent.options(SERVER_URL + '/api/v1/cloudron/status')
                 .set('Access-Control-Request-Method', 'GET')
                 .set('Access-Control-Request-Headers', 'accept, origin, x-superagented-with')
                 .set('Origin', 'http://localhost');
@@ -98,7 +98,7 @@ describe('Server', function () {
         });
 
         it('does not crash for malformed origin', async function () {
-            const response = await superagent('OPTIONS', SERVER_URL + '/api/v1/cloudron/status')
+            const response = await superagent.options(SERVER_URL + '/api/v1/cloudron/status')
                 .set('Origin', 'foobar')
                 .ok(() => true);
             expect(response.status).to.be(405);
diff --git a/src/test/syslog-test.js b/src/test/syslog-test.js
index d1b79d9a2..5734eac4e 100644
--- a/src/test/syslog-test.js
+++ b/src/test/syslog-test.js
@@ -36,7 +36,7 @@ async function verifyMessage(pattern, fileName) {
     if (found === null) throw new Error(`${pattern} not found in ${fileName}`);
 }
 
-describe('Daemon', function () {
+describe('Syslog', function () {
     this.timeout(5000);
 
     after(async function () {
diff --git a/src/users.js b/src/users.js
index 752a55b50..f963377e9 100644
--- a/src/users.js
+++ b/src/users.js
@@ -100,7 +100,7 @@ const appPasswords = require('./apppasswords.js'),
     uaParser = require('ua-parser-js'),
     userDirectory = require('./user-directory.js'),
     uuid = require('uuid'),
-    superagent = require('superagent'),
+    superagent = require('./superagent.js'),
     util = require('util'),
     validator = require('validator'),
     _ = require('./underscore.js');
@@ -755,7 +755,7 @@ async function notifyLoginLocation(user, ip, userAgent, auditSource) {
     if (user.ghost || user.source) return; // for external users, rely on the external source to send login notification to avoid dup login emails
 
     const response = await superagent.get('https://geolocation.cloudron.io/json').query({ ip }).ok(() => true);
-    if (response.statusCode !== 200) return debug(`Failed to get geoip info. statusCode: ${response.statusCode}`);
+    if (response.status !== 200) return debug(`Failed to get geoip info. status: ${response.status}`);
 
     const country = safe.query(response.body, 'country.names.en', '');
     const city = safe.query(response.body, 'city.names.en', '');
diff --git a/src/wellknown.js b/src/wellknown.js
index 78fd4e9db..4073b6197 100644
--- a/src/wellknown.js
+++ b/src/wellknown.js
@@ -13,7 +13,7 @@ const assert = require('assert'),
     mail = require('./mail.js'),
     mailServer = require('./mailserver.js'),
     safe = require('safetydance'),
-    superagent = require('superagent');
+    superagent = require('./superagent.js');
 
 const MAIL_AUTOCONFIG_EJS = fs.readFileSync(__dirname + '/autoconfig.xml.ejs', { encoding: 'utf8' });