Add config/routes.js and privilage protect