added /auth endpoint