cros + controllers + auth