a more secure version with fixed routes