Session start moved to /auth