create meaningful routes and restrict request method access