fix validation error for unique/user keys
fix double-render error with auth
use :key instead of :name for secret routes