fix auth routing bug