user auth
moving authentication into its own controller