fixed typo in appsecurity, add option to guard route via a confirmed flag