Full review (do not merge)

Should be fixed in 75b106ee9ea9ca. The code is used by two controllers (regular & api) so I put it into helper class - is that OK?