routes.md - expand `/user/auth`