adds new route handling

I would return a 401 instead.