controller and auth, lib will remove soon.