lock down routes