BT: moved auth to header in rest of controllers, green tests, need deeper testing in real enviroment, close todo