moved logic from html to controller

added simple authentication