restrict auto-generated routes