controller routes and validation