add AuthedApp, refactor controllers.