separate public routes from those that require authentication