[FIX] only make POST route private on setup