security added to update routes