Restrict client routes that require login