auth check on desktop route