auth.js - remove end() from redirect()