updated route and added access check