add Login and Authorization controller plugins, refactor base permissions