added POST /users/<slug>/auth