moving auth inside controller