User is still able to access the protected route