auth now applies to all paths except the root / path