moved auth to controller actions