make /auth internal only, and match it explicity