Express server for an artists website
Some suggestions:


Rewrite the line of code app.get(['/bio', '/contact', '/login', '/works', '/404', '/bug', '/edit-bio', '/edit-works'] ... to be readable and maintainable and debuggable.  It should likely be broken into at least two separate routes.
Separate into different route definitions the paths that care about calling verify() and the ones that don't.
Use express.static for routes that don't appear to have any special processing such as ['/bio', '/contact', '/login', '/works', '/404', '/bug'].
Use res.sendFile() instead of repeating this err ? res.status(500).end() : res.end(data) over and over again.
Put your verify logic into a middleware format so it can easily be attached to any route.