changed routes to use username instead of id, makes easier to read