reworking controllers to be REST-only