added before filters to control access, added routes