Fixed route security bug with dynamic routes