# route should match when :id IS NOT session or user or password

:requirements => { :id => /(?!session|user|passwords)/ }

# rails doesn't want anchor characters such as ^