add auth routes