move routes and authorization