provide a way to specify controllers
remove admin auth, let users subclass and provide their own auth system