add routes for callback, logout