moved auth routing to its own file