doesn't start with /auth