move Auth validation into URL routing