Put the auth into a utility module of its own (it's not a controller)