refactors user auth out of app controller