added controllerclassloader & initial auth
both untested