dont use root path for auth