refactor API into proper controllers and routes