moved auth routes to /api