fix authCtrl.js use of API_URL; clean up controllers