Add authorization, begin work on cleaning up controllers from scaffolding