removed basic auth from app controller