create auth routes only after plugin system is enabled and auth.init hook is fired