recursively load controllers
add check for user when posting to api/portfolios
add more to /api/portfolios