rm all the auth logic from controllers - close #7