you aren't authorized to access any routes except API routes