controllers: extract auth logic to auth.py, add auth for stats-page