auto-login token (barebones version)

also: controller DB's now added from core, not in their own constructors