Lock down some resource routes

Signed-off-by: Max Fierke <max@maxfierke.com>