proper redirect after auth