modify readme + add tip to protect routes