separated auth and open static paths