seperated auth routes from api routes