more auth, cleaning up controllers, and flash messages