BT: moved auth to header in rest of controllers, green tests, need deeper testing in real enviroment, close todo
Merge remote-tracking branch 'github/auth' into auth