It seems that there is more use cases to cover with this behaviour, for example when someone enters /auth directly and logs in from there.