Move the auth logic to the sessions controller
Do the same with the views
Output signed reques
Add callback view
Remove raise
Redirect to page canvas