moved the auth routes to a module