ca: add authentication state controller (logged out only) and service