allowed routes can now use wildcards