Protect all routes

Not all routes were protected with passport (user logged in)