move the api auth check to controller