semi-ugly auth controller