Maybe it will be better to prevent exposing route in https://github.com/refinery/refinerycms-settings/blob/master/config/routes.rb.