moved only auth routes to separate auth group so they did not get overwritten