rejigged controllers and routing, note: authorization needs to be redone