remove redirects from non-web client auth routes