refactor the security design.  security belongs to the webapp as a whole, not to endpoints
add newcontroller() to Webapp
use methods instead of public functions for creating endpoints
various webapp and controller refactoring
fix endpoint tests
remove controller test.  put this logic in the endpoint test