make routes secure as well