moved around auth so / is only non-login item.