secured /api endpoint, added fake /test route