move auth to separate route