indent auth controller

was kind of difficult to keep track of things
TODO is a keyword that shows up in an editor that understands it (like textmate)