Proper authentication on controllers