due to the backend switching to membership authorization by default, we no longer have the .well-known endpoint, so we need to code the paths in static