Updated routes.js for SECURITY