wip: add auth controller