diff --git a/app/routes/forms.server.routes.js b/app/routes/forms.server.routes.js
index 7d2e3e14..601744a7 100644
--- a/app/routes/forms.server.routes.js
+++ b/app/routes/forms.server.routes.js
@@ -32,7 +32,7 @@ module.exports = function(app) {
 
    	app.route('/forms/:formIdFast([a-zA-Z0-9]+)')
         .post(forms.createSubmission);
-	
+
 	app.route('/forms')
 		.get(auth.isAuthenticatedOrApiKey, forms.list)
 		.post(auth.isAuthenticatedOrApiKey, forms.create);
@@ -47,8 +47,9 @@ module.exports = function(app) {
 		.get(auth.isAuthenticatedOrApiKey, forms.hasAuthorization, forms.listSubmissions)
 		.delete(auth.isAuthenticatedOrApiKey, forms.hasAuthorization, forms.deleteSubmissions);
 
-	app.route('/forms/:formIdNoMiddleware([a-zA-Z0-9]+)/visitors')
-		.get(auth.isAuthenticatedOrApiKey, forms.getVisitorData);
+	app.route('/forms/:formId([a-zA-Z0-9]+)/visitors')
+		.get(auth.isAuthenticatedOrApiKey, forms.hasAuthorization, forms.getVisitorData);
+
 	// Slower formId middleware
 	app.param('formId', forms.formByID);