starting to take auth out of urls