Mixed up protected and unprotected routes