fix auth url

this is better because it doesn't include the hash params