multiple route objects and authorisation