fix security for prefix path /auth