added made api routes protected