auth and header controller setup