/auth, not /authenticate