fix routes for auth