fixing auth route and client credentials flow