fixed the routes: direct to site#show and check for auth there