move auth stuff to its own controller file
use new indieauth client