fix insecure wildcard route