added routes with permissions