update routes - locked them down for authenticated users