main: update routes to disallow all path prefixes