exposing controllers
locking it down
cleaned up routes file