FIX: routes now have a secure parameter (bool)