protected routes in API and displayed tags in ui