add auth to url path