protect routes that take an ID in param by restricting the characters set to numbers