why /.well-known/citrons/auth? why not just /citrons/auth?