allow action only defined routes