changed route to only detel on authorization