restrict access to all post and delete routes