Routes should go into the auth grouping.