updated routes, models, and auth