Turned off routes. Let the app define it. Else, left open as a security hole.