Change OptionalAuth to controller, for easier injection of user service