Change /auth to use @authrequired.
Add call to invalidate auth token.