Refactorized auth controllers.

Now controllers only have presentation logic. All domain
logic is moved to separate transactional service functions.