overriding auth controller messed with sessions..