protect puzzle xhr routes