scope to /auth