clean up hardcoded URLs.
change path and add access check to auth callback.