restrict auto generated routes