Fixed bug in auth.js where state transitions previously included a slash