routing with security (doesn't work)