fix routes for user authentication