moved from middlewares to controllers