moved some authentication to the model from the controller