Move authentication query from controller to service