redirect to root if no auth