make sure routes global auth is correct in readme