redirect to root on failed authentication