Separate logic out of controller, add security, add deleting