clean up controllers and make stricter routes
add password protection to settings page