authRender serves auth.html, not setup.html