fixes OAuth2 bug that was allowing access with /auth route