fixed routing and authentication