changed strategy to auth
refactored routes (not working yet)