remove redirects from non-web client auth routes
merged in master