fix: only restrict api routes