root to /habits and protect routes from unauthorized users