changed routes.draw to routes.append to protect json requests