security:: lock down via routes