fix auth app url again

origin includes http