friends dont let friends store sensitive information in route URLs