user routes user.* -> auth.user.*