remove 'api' from route
add security layer