move authenticate to top api controller