auth module (need to move auth routes out of db)