all candidate routes properly check permissions and return proper values