move auth controller to separate module