controller - don't update regions until we confirm authentication