Appear to be back to what I had yesterday, but with my controllers able to access goals, which means I can make API calls from anywhere and access the logged in user.