added todos and modified login requirements in controllers