auth: add /v1 to non-OAuth API paths