inject auth into route, controller, and view
action redir implementation
remove unused 'module' base class