some put routes has auth_token in url