reverted header auth
route matching is case sensitive
updated to test header auth
removed sessionstart()
moved
updated paths