add route for auth