abstract routes out of app.js
updated flow of auth