secued api and session, add protected routing namespace