Moving authentication logic from controller to model.