Protected: Web vs API routes