a few controller tweaks and a reimplementation of GET /api/borrow