move towards using Passport, create controller