api auth controller modified again