removed TODO - shouldn't authenticate request in frontend controller before making forward