authenticate states for ui routes. disable inputs while updating.