Split up into multiple controllers.
Simplify password checking.
Move login/create user to their own partials.