finish base flask routes (untested)