API auth, some route problems