added root to the list of permitAll matchers to allow home redirect without login