moved auth out of controller