Help understanding Auth0: SPA do you need the custom API?