Fix: prevent double-firing of authController