authentication + routes complete