client sided access rights for routes