why would someone have both /.well-known/citrons/auth and /citrons/auth?