customise routes and limit sessions only