Refactor routes.js and create auth.js