put public functions into object, kept controller private

controller also not global var now
clarification: controller not exposed to client (ie Chrome)
so that client cannot modify controller properties