add(): blocked non-admin users for saving to DB. client-side dummy solution
fix(html5 mode): removed url attribute from states. no path concating