auth for all routes / static files