got authentication and nested routes working