(refactor) Auth factory now uses ServerRoutes