various bug fixes related to authn. checks

also, shuffled class hierarchy for controller around once more.