Authorize and authenticate urls are different