Update auth API routes with /api in mind

I.e. next route shouldn't require the host and method

Can have an optional "base" param which would be new.sfucsss.org, sfucsss.org, dev-branch.sfucsss.org, ...