stripped user auth stuff from index.js
major overhaul, statemanager on controller, bi-directional state updates