put back auth from controller to delete database