minor fix for security question in routes