refactoring: added controller; auth before other endpoint handlers