fix routing logic in /auth