- controller: move auth handle to controller driver