protecting some dev routes