Add /user/current lookup to fix security side of things. Tweak route config