adjust routing to support pushstate
add user auth