cleanup, split config out into separate module, fixed static routes so views can't be accessed