removed password from routes