fixed locals.URLS.AUTH