Deny plain old browser access.
Include all files in "app/routes" dir.