all routes defined, except forgottoken / activate user