changed route urls and added user auth