Changed `auth` config such that protected routes are defined under the strategies