use controller as a very dumb and basic implementation for auth