Move authentication into auth controller