fixed auth routes