start cleaning up controllers and add methods to user model for authoriz...

...ation