placed auth globally, fixed routes to challenges, user show page