some additional cleanup
added cookie authentication for settings save
ordered the controller methods