initial routes including oAuth