oops... make sure the salt is the same for both the encryption and decryption
kill the old security API and add the route