now allowing auth strategy for non-LTM routes and enforcing auth:false for LTM