make auth endpoint replaceable