Moved all of the authentication from the api controller to this engine