refactored the whole auth mess
various fixes
route prefixe and regexp
improved recursive get()