have authentiation at /auth instead