moved pin auth to the controller