change some routes; cross domain auth not work. wtf?