Bugfix: If only specific routes are enabled, deny everything else