Moved authentication out of controllers