ignore .env
use env for auth callback path as well