fixed user to point to /auth/user.js vs /routes/user.js