Fixed auth in routes