Set REST routes explicitly with `only` instead of `except`