Pre auth

basically all the routes now respect security.
Should this be of type branch or project?
i.e. should this be @PreAuthorize("hasPermission(#branchId, 'branch, 'admin')")