Restricting non-public routes