auth and callback locators