security model page: talk about permissions needed to create public routes.

[teleclimber]

should also talk about permission for public routes for data exfiltration threat