all routes now except login need authentication