1
include success redirect in .authenticate
remove auth