refactored routes and handlers, removed permission